6.5 Medium

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query…

CVE-2026-62147

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

Assessment

CVSS: 6.5 (v3.1)
Severity: Medium
EPSS: 0.35% chance of exploitation in the next 30 days
Known exploited: Not listed in CISA KEV
Exploit availability: Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
Published: 13 July 2026
Last updated: 31 October 2026
Affected: Red Hat
Assigner: redhat

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

At the source

EUVD (ENISA)

References

https://access.redhat.com/errata/RHSA-2026:33612
https://access.redhat.com/security/cve/CVE-2026-62147
https://bugzilla.redhat.com/show_bug.cgi?id=2499635

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2026-62147