Description
The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift distributed tracing 3.10.1 | — | — |
References
- RHSA-2026:33612 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-62147 vdb-entry
- RHBZ#2499635 issue-tracking