{"answers":{"affected":"3 open source packages ship an affected version, including github.com/grafana/tempo-operator.","exploited":"There is no known exploitation of CVE-2025-2842 in the wild and no public exploit code.","fix":"Upgrade github.com/grafana/tempo-operator to 0.16.0 or later.","what":"CVE-2025-2842 is a medium-severity vulnerability in Red Hat OpenShift distributed tracing 3, published on 2 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-2842 and fix it if it is affected.\n\nWhat it is: CVE-2025-2842 is a medium-severity vulnerability in Red Hat OpenShift distributed tracing 3, published on 2 Apr 2025. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-2842 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/grafana/tempo-operator (Go): affected all versions; fixed in 0.16.0\n- github.com/grafana/tempo-operator (Go): affected all versions; fixed in 0.16.0\n- github.com/grafana/tempo-operator (Go): affected all versions; fixed in 0.16.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-2842/ (Markdown: https://insights.sbomify.com/CVE-2025-2842/index.md)","id":"CVE-2025-2842","markdown":"https://insights.sbomify.com/CVE-2025-2842/index.md","name":"CVE-2025-2842","record":{"aliases":["GHSA-5xf3-gmx4-529v","GO-2026-5161"],"analysis":{"component_type":"cloud_service","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"OpenShift Tempo Operator","requires_auth":"low_privilege","summary":"Attackers with specific namespace permissions can read service account tokens to access all cluster metrics when Jaeger UI monitoring is enabled.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[],"cvss":{"score":4.3,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole.\nThis can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Tempo-operator: tempo operator token exposition lead to read sensitive data","id":"CVE-2025-2842","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"information_disclosure","year":"2025"},"n_packages":3,"n_references":5,"next":{"headline":"Observability-operator: observability operator privilege escalation","id":"CVE-2025-2843"},"packages":[{"ecosystem":"Go","fixed":["0.16.0"],"introduced":["0"],"last_affected":[],"package":"github.com/grafana/tempo-operator","purl":null,"source":"GHSA-5xf3-gmx4-529v"},{"ecosystem":"Go","fixed":["0.16.0"],"introduced":["0"],"last_affected":[],"package":"github.com/grafana/tempo-operator","purl":"pkg:golang/github.com/grafana/tempo-operator","source":"GHSA-5xf3-gmx4-529v"},{"ecosystem":"Go","fixed":["0.16.0"],"introduced":["0"],"last_affected":[],"package":"github.com/grafana/tempo-operator","purl":"pkg:golang/github.com/grafana/tempo-operator","source":"GO-2026-5161"}],"prev":{"headline":"Cart66 Cloud \u003c= 2.3.7 - Unauthenticated Information Exposure","id":"CVE-2025-2841"},"products":["Red Hat OpenShift distributed tracing 3","Red Hat OpenShift distributed tracing 3.5.3"],"published":"2025-04-02","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-08","vendors":["Red Hat"]},"summary":"Attackers with specific namespace permissions can read service account tokens to access all cluster metrics when Jaeger UI monitoring is enabled.","url":"https://insights.sbomify.com/CVE-2025-2842/"}