https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 16:32:19 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-365371 EUVD-2026-365371 https://cve.radiocsirt.org/vuln/euvd-2026-365371 https://cve.radiocsirt.org/vuln/fkie_cve-2025-2786 <p>A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users&#39; permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.</p> <p>A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users&#39; permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-2786 https://cve.radiocsirt.org/vuln/ghsa-28gr-56hr-prp6 <p><strong>Affected:</strong> Go: github.com/grafana/tempo-operator</p> <p>A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users&#39; permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.</p> <p><strong>Affected:</strong> Go: github.com/grafana/tempo-operator</p> <p>A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users&#39; permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.</p> https://cve.radiocsirt.org/vuln/ghsa-28gr-56hr-prp6 https://cve.radiocsirt.org/vuln/rhsa-2025:3607 <p>tempo-operator: ServiceAccount Token Exposure Leading to Token and Subject Access Reviews in OpenShift Tempo Operator tempo-operator: Tempo Operator Token Exposition lead to read sensitive data golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing</p> <p>tempo-operator: ServiceAccount Token Exposure Leading to Token and Subject Access Reviews in OpenShift Tempo Operator tempo-operator: Tempo Operator Token Exposition lead to read sensitive data golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing</p> https://cve.radiocsirt.org/vuln/rhsa-2025:3607 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0711 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0711