CVE-2025-2786

Description

A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.

Reserved 2025-03-25 | Published 2025-04-02 | Updated 2025-05-22 | Assigner redhat

Problem types

Exposure of Sensitive Information to an Unauthorized Actor

Product status

Default status
unaffected

Any version before 0.15.3
affected

Default status
affected

sha256:233132300a9f5f019047a414b240f5b32c7563af8107bb52c4395892fdcd0fe0 before *
unaffected

Default status
affected

sha256:e0e3273eceb8339638f2f1d91bb5eb6a57cfc0bc1442fcdea5fcff36812ccb4c before *
unaffected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Default status
affected

Timeline

2025-03-25:	Reported to Red Hat.
2025-03-25:	Made public.

References

access.redhat.com/errata/RHSA-2025:3607 (RHSA-2025:3607) vendor-advisory

access.redhat.com/errata/RHSA-2025:3740 (RHSA-2025:3740) vendor-advisory

access.redhat.com/security/cve/CVE-2025-2786 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2354811 (RHBZ#2354811) issue-tracking

cve.org (CVE-2025-2786)

nvd.nist.gov (CVE-2025-2786)

Download JSON