Executive brief
A security flaw in the Grafana Tempo Operator, a tool used for managing distributed tracing data, could allow unauthorized users to view sensitive permission information. By exploiting how the software sets up internal service accounts, a user with access to a specific workspace could potentially see what other users are allowed to do across the system. While this does not allow an attacker to take over accounts directly, it provides valuable reconnaissance data that could be used to plan more serious future attacks.
Technical details
A vulnerability exists in Grafana Tempo Operator where the deployment of TempoStack or TempoMonolithic instances automatically creates a ServiceAccount, ClusterRole, and ClusterRoleBinding with excessive permissions. An attacker with full access to a namespace can extract the ServiceAccount token and use it to perform TokenReview and SubjectAccessReview API requests. While this does not facilitate direct privilege escalation or impersonation, it allows the attacker to map out the permissions and access levels of other users in the cluster. The issue is addressed in version 0.16.0 by requiring explicit user permissions for these actions when multi-tenancy is enabled.
Affected products
- Grafana tempo-operator < 0.16.0
Timeline
- 2025-03-25: other: Initial report in Red Hat Bugzilla
- 2025-04-02: disclosed: Public disclosure of CVE-2025-2786
- 2025-04-02: advisory: GitHub Advisory published
- 2025-04-04: patched: Red Hat released security advisory RHSA-2025:3607