CVE-2026-62147

{
  "id": "CVE-2026-62147",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-13T12:16:34.927",
  "lastModified": "2026-10-24T22:10:00.210",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces."
    },
    {
      "lang": "es",
      "value": "El componente de puerta de enlace del Operador de Tempo falló al aplicar consistentemente la redacción con ámbito de espacio de nombres en algunas rutas de respuesta de la API de consulta cuando RBAC de consulta estaba habilitado, permitiendo a un usuario autenticado leer atributos de span pertenecientes a los espacios de nombres de otros inquilinos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhosdt/tempo-operator-bundle",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ]
        },
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift distributed tracing 3",
          "defaultStatus": "affected",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhosdt/tempo-rhel9-operator",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-13T13:43:40.942746Z",
          "id": "CVE-2026-62147",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-62147",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499635",
      "source": "[email protected]"
    }
  ]
}