Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.3 release
Affects Red Hat Product Security Red HatSource GCVE Database
Not known to be exploited · CVSS 8.7 High.
Data as of 10/25/2026, 12:12:10 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
Description
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features and security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * This release upgrades Tempo to version 2.10.10. Bug fixes: * None Known issues: * None
Weaknesses
- CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)
Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
- CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
References
- access.redhat.com/errata/RHSA-2026:88187 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-108859 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2026-111943 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88187.json (opens in a new tab)