The vulnerability CVE-2025-2786 in Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 arises from the Tempo Operator creating a ServiceAccount, ClusterRole, and ClusterRoleBinding when deploying TempoStack or TempoMonolithic instances. Users with full access to their namespace can extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests. This behavior exposes information about other users' permissions within the cluster. Although this does not enable privilege escalation or impersonation, it leaks sensitive information that could facilitate further attacks. Red Hat has assigned a moderate impact rating and a CVSS v3.1 score of 4.3 (Low confidentiality impact, no integrity or availability impact). Currently, there is no available mitigation or patch for this issue. The advisory recommends careful auditing of permissions and namespace deployments as a workaround.

The vulnerability allows users with full access to their namespace to extract a ServiceAccount token and perform TokenReview and SubjectAccessReview requests, potentially disclosing information about other users' permissions in the cluster. This information exposure does not permit privilege escalation or impersonation but may assist attackers in reconnaissance for further attacks. The confidentiality impact is low, and there is no impact on integrity or availability. Red Hat rates the impact as moderate with a CVSS base score of 4.3.

Currently, no official mitigation or patch is available for this vulnerability. As a workaround, it is recommended to deploy TempoStack or TempoMonolithic instances in dedicated namespaces and carefully audit which users have permission to read Secrets in these namespaces. Monitor Red Hat advisories for updates or patches addressing this issue.