https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 04:24:52 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-365372 EUVD-2026-365372 https://cve.radiocsirt.org/vuln/euvd-2026-365372 https://cve.radiocsirt.org/vuln/fkie_cve-2025-2842 <p>A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has &#39;create&#39; permissions on TempoStack and &#39;get&#39; permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.</p> <p>A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has &#39;create&#39; permissions on TempoStack and &#39;get&#39; permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-2842 https://cve.radiocsirt.org/vuln/ghsa-5xf3-gmx4-529v <p><strong>Affected:</strong> Go: github.com/grafana/tempo-operator</p> <p>A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has &#39;create&#39; permissions on TempoStack and &#39;get&#39; permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.</p> <p><strong>Affected:</strong> Go: github.com/grafana/tempo-operator</p> <p>A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has &#39;create&#39; permissions on TempoStack and &#39;get&#39; permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.</p> https://cve.radiocsirt.org/vuln/ghsa-5xf3-gmx4-529v https://cve.radiocsirt.org/vuln/rhsa-2025:3607 <p>tempo-operator: ServiceAccount Token Exposure Leading to Token and Subject Access Reviews in OpenShift Tempo Operator tempo-operator: Tempo Operator Token Exposition lead to read sensitive data golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing</p> <p>tempo-operator: ServiceAccount Token Exposure Leading to Token and Subject Access Reviews in OpenShift Tempo Operator tempo-operator: Tempo Operator Token Exposition lead to read sensitive data golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing</p> https://cve.radiocsirt.org/vuln/rhsa-2025:3607 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0711 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0711