CVE-2026-62147 Overview
CVE-2026-62147 is an authorization flaw [CWE-863] in the Tempo Operator's gateway component. When query role-based access control (RBAC) is enabled, the gateway fails to consistently apply namespace-scoped redaction on certain query API response paths. An authenticated tenant can read span attributes belonging to other tenants' namespaces through affected query endpoints.
The issue exposes distributed tracing data across tenant boundaries in multi-tenant observability deployments. Red Hat tracks the flaw under advisory CVE-2026-62147 and bug report #2499635.
Critical Impact
Authenticated users can read span attributes from other tenants' namespaces, breaking multi-tenant isolation for distributed tracing data managed by the Tempo Operator gateway.
Affected Products
- Tempo Operator gateway component (Red Hat distribution)
- Deployments with query RBAC enabled
- Multi-tenant Tempo installations exposing the query API
Discovery Timeline
- 2026-07-13 - CVE-2026-62147 published to the National Vulnerability Database (NVD)
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-62147
Vulnerability Analysis
The Tempo Operator gateway enforces multi-tenant isolation by applying namespace-scoped redaction to query results when query RBAC is enabled. The redaction filters span attributes so that tenants only see data for namespaces they are authorized to access.
CVE-2026-62147 stems from inconsistent enforcement of this redaction across the gateway's query API surface. Some response paths return span attributes without applying the tenant-scoped filter. An authenticated user issuing queries against those endpoints receives span attributes tied to namespaces owned by other tenants.
The result is a confidentiality breach limited to span attribute content. Integrity and availability of trace data are not affected, matching the CVSS impact metrics C:H/I:N/A:N.
Root Cause
The root cause is an authorization gap in the gateway component. Query RBAC policy checks are not uniformly wired into every response path that returns span attribute data. When a request reaches an unpatched path, the gateway serializes attributes without consulting the namespace-scoped policy.
This matches the pattern described by CWE-863: Incorrect Authorization, where an access control decision is made but does not correctly cover all resources.
Attack Vector
Exploitation requires an authenticated account with query access to the gateway. The attacker submits a query that targets an affected API path. The gateway returns span attributes without filtering for the requesting tenant's namespace scope, disclosing trace data from other tenants.
No user interaction is required and the attack complexity is low. Because the flaw only surfaces cross-tenant data through query responses, it does not enable modification of trace data or denial of service.
No verified proof-of-concept code is publicly available. See the Red Hat CVE-2026-62147 Advisory and Red Hat Bug Report #2499635 for vendor technical details.
Detection Methods for CVE-2026-62147
Indicators of Compromise
- Query API requests from tenant accounts returning span attributes referencing namespaces outside the tenant's authorized scope.
- Unusual volumes of query API calls from a single authenticated principal enumerating trace identifiers or attribute keys.
- Gateway access logs showing successful responses on query paths that lack a tenant namespace filter parameter.
Detection Strategies
- Audit gateway access logs for query API endpoints and correlate the responding namespaces against the requesting tenant's RBAC bindings.
- Compare span attribute payloads returned to each tenant with the namespaces assigned to that tenant in the RBAC configuration.
- Alert on authenticated principals that issue broad queries without namespace selectors when query RBAC is enabled.
Monitoring Recommendations
- Ingest Tempo gateway access and audit logs into a centralized log platform for cross-tenant query analysis.
- Track per-tenant query volume, response sizes, and distinct namespaces referenced in returned span attributes.
- Review Kubernetes audit logs for changes to Tempo Operator custom resources that alter RBAC scope or gateway configuration.
How to Mitigate CVE-2026-62147
Immediate Actions Required
- Apply the Tempo Operator update referenced in the Red Hat CVE-2026-62147 Advisory as soon as it is available for your channel.
- Inventory Tempo Operator deployments and identify those with query RBAC enabled and multiple tenants configured.
- Restrict query API access to trusted principals until the patched gateway version is deployed.
Patch Information
Red Hat has published tracking information for CVE-2026-62147 under the Red Hat CVE-2026-62147 Advisory and Red Hat Bug Report #2499635. Consult the advisory for fixed component versions and update instructions specific to your Red Hat subscription and Tempo Operator channel.
Workarounds
- Disable query RBAC-dependent multi-tenant query access on the gateway until the fix is applied, if the deployment can tolerate reduced functionality.
- Isolate tenants that require strict confidentiality into separate Tempo Operator instances rather than sharing a single gateway.
- Enforce network-level access controls on the gateway query API so that only vetted clients can reach affected endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
