---
id: CVE-2026-62147
title: 'Tempo-operator: tempo operator: query rbac bypass'
summary: >-
  The Tempo Operator's gateway component failed to consistently apply
  namespace-scoped redaction on some query API response paths when query RBAC
  was enabled, allowing an authenticated user to read span attributes belonging
  to other tenant…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: Red Hat
product: rhosdt/tempo-operator-bundle
affected:
  - rhosdt/tempo-operator-bundle (all versions)
  - rhosdt/tempo-rhel9-operator (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-13T13:43:40.942746Z'
published: '2026-07-13'
updated: '2026-10-31'
sourceUpdated: '2026-10-31T03:58:23.942Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62147'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:33612'
    label: 'RHSA-2026:33612'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-62147'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2499635'
    label: RHBZ#2499635
tags:
  - cve.org
epss: 0.00402
epssPercentile: 0.3465
ingestedAt: '2026-11-05T16:24:31.534Z'
---

## Overview

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces.

## Affected

- `rhosdt/tempo-operator-bundle (all versions)`
- `rhosdt/tempo-rhel9-operator (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

There is no mitigation or workaround other than upgrading to tempo-operator.v0.21.0-2 (or later); until upgraded, administrators requiring strict namespace isolation of trace data should not rely on query RBAC alone and should consider restricting access to the Tempo query API at the network/route level as a temporary compensating control.