Executive Summary

CVE-2025-2842: Tempo Operator flaw creates a ClusterRoleBinding granting the cluster-monitoring-view role to the Tempo service account when the Jaeger UI Monitor Tab is enabled. Users with create permissions on TempoStack and get permissions on Secrets can read the service account token, exposing all cluster metrics. Not listed in CISA KEV.

---

Authoritative CVE Metadata - CVSS Base Score: 4.3 (MEDIUM) - Published: 2025-04-02T12:15:14.677 - Last Modified: 2026-08-19T03:16:52.157

Original Description: A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

"Time stays long enough for anyone who will use it."

— Leonardo da Vinci