CVE-2025-2786

MEDIUM 4.3

Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator

CVSS Score

4.3

EPSS Score

0.2%

EPSS Percentile

44th

A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.

CWE	CWE-200
Published	Apr 2, 2025
Last Updated	Mar 22, 2026

Stay Ahead of the Next One

Get instant alerts for

Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

Red Hat / Red Hat OpenShift distributed tracing 3.5.1

All versions affected

Red Hat / Red Hat OpenShift distributed tracing 3.5.1

All versions affected