The vulnerability in Red Hat OpenShift distributed tracing 3 involves the Tempo Operator's gateway component failing to consistently apply namespace-scoped redaction on some query API response paths when query Role-Based Access Control (RBAC) is enabled. This incorrect authorization issue permits an authenticated user to access span attributes belonging to other tenants' namespaces, violating tenant isolation in multi-tenant environments. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges but no user interaction. The impact is confidentiality loss of span attributes without integrity or availability impact. No patch or official remediation level has been stated in the vendor advisory as of the published date. The vendor advisory URL is provided for ongoing updates.

An authenticated user with query RBAC enabled can read span attributes from namespaces belonging to other tenants, leading to unauthorized disclosure of potentially sensitive tracing information. This compromises confidentiality but does not affect integrity or availability of the system.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-62147 for current remediation guidance. Until an official fix is available, consider restricting query RBAC permissions to trusted users only and monitor access to the Tempo Operator's query API to limit exposure.