Executive brief
The Grafana Tempo Operator, which manages distributed tracing for applications, contains a security flaw that could allow unauthorized users to view sensitive cluster-wide performance metrics. If the Jaeger UI Monitor Tab is enabled, the system incorrectly grants broad monitoring permissions to a service account. An attacker with limited access to a specific namespace could exploit this to steal security tokens and gain visibility into the health and performance data of the entire server cluster.
Technical details
A vulnerability exists in the Grafana Tempo Operator (CWE-200) due to the improper creation of a ClusterRoleBinding. When the Jaeger UI Monitor Tab is enabled, the Operator grants the 'cluster-monitoring-view' ClusterRole to the Tempo instance's Service Account. An attacker with 'create' permissions on TempoStack and 'get' permissions on Secrets within a namespace can retrieve the Service Account token. This token can then be used to access sensitive cluster metrics across the entire environment. The issue is fixed in version 0.16.0.
Affected products
- Grafana tempo-operator < 0.16.0
Timeline
- 2025-03-27: other: Reported to Red Hat Bugzilla
- 2025-04-02: disclosed: Public disclosure of CVE-2025-2842
- 2025-04-02: advisory: GitHub Advisory published
- 2025-04-04: patched: Red Hat released security advisory RHSA-2025:3607