Threats tagged 'ghsa-8j3g-mc7h-vfff'

The Tempo Operator's gateway component in Red Hat OpenShift Tempo 3.10.1 failed to consistently apply namespace-scoped redaction on some query API responses when query RBAC was enabled. This allowed authenticated users to read span attributes belonging to other tenants' namespaces. The issue has been fixed in the 3.10.1 release, which correctly redacts all Tempo API responses according to namespace access rights.