A vulnerability in the Grafana Tempo Operator (CVE-2025-2842) allows exposure of sensitive information to unauthorized actors. When the Jaeger UI Monitor Tab is enabled, the Operator creates a ClusterRoleBinding granting the cluster-monitoring-view ClusterRole to the Tempo instance's Service Account. If a user has 'create' permissions on TempoStack and 'get' permissions on Secrets in a namespace, they can read the Tempo service account token and access all cluster metrics. This affects versions prior to 0.16.0 and has been fixed in version 0.16.0.