Executive Summary

CVE-2025-2842: Tempo Operator flaw creates a ClusterRoleBinding granting cluster-monitoring-view to the Tempo service account when Jaeger UI Monitor Tab is enabled. Users with create permissions on TempoStack and get permissions on Secret can read the service account token, exposing all cluster metrics. Not yet listed in CISA KEV.

---

Authoritative CVE Metadata - CVSS Base Score: 4.3 (MEDIUM) - Published: 2025-04-02T12:15:14.677 - Last Modified: 2026-09-07T22:17:20.820

Original Description: A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.

"Being right is highly overrated. Even a stopped clock is right twice a day."

— Unknown