GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-2786 (GCVE-0-2025-2786)

Vulnerability from cvelistv5 – Published: 2025-04-02 11:07 – Updated: 2026-09-08 21:26
VLAI
Title
Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator
Summary
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks.
Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-02 13:53 UTC
CWE
  • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
Vendor Product Version CPE status
Affected: 0 , < 0.15.3 (semver)
Red Hat Red Hat OpenShift distributed tracing 3.5.3 Unaffected: rhosdt-3.5-1743162265 , < * (rpm)
    cpe:/a:redhat:openshift_distributed_tracing:3.5::el8
Create a notification for this product.
Red Hat Red Hat OpenShift distributed tracing 3.5.3 Unaffected: rhosdt-3.5-1744028971 , < * (rpm)
    cpe:/a:redhat:openshift_distributed_tracing:3.5::el8
Create a notification for this product.
Red Hat Red Hat OpenShift distributed tracing 3     cpe:/a:redhat:openshift_distributed_tracing:3
Create a notification for this product.
Date Public
2025-03-25 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-2786",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T13:53:24.818603Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-02T13:53:48.875Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/grafana/tempo-operator",
          "defaultStatus": "unaffected",
          "packageName": "tempo-operator",
          "versions": [
            {
              "lessThan": "0.15.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-rhel8-operator",
          "product": "Red Hat OpenShift distributed tracing 3.5.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.5-1743162265",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-rhel8-operator",
          "product": "Red Hat OpenShift distributed tracing 3.5.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "rhosdt-3.5-1744028971",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-gateway-opa-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-gateway-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-jaeger-query-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-query-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-rhel8",
          "product": "Red Hat OpenShift distributed tracing 3",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2025-03-25T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users\u0027 permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T21:26:17.376Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2025:3607",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3607"
        },
        {
          "name": "RHSA-2025:3740",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:3740"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2025-2786"
        },
        {
          "name": "RHBZ#2354811",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354811"
        },
        {
          "url": "https://github.com/grafana/tempo-operator/pull/1145"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-03-25T11:13:18.903Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2025-03-25T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator",
      "workarounds": [
        {
          "lang": "en",
          "value": "Currently, no mitigation is available for this vulnerability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2025-2786",
    "datePublished": "2025-04-02T11:07:43.285Z",
    "dateReserved": "2025-03-25T10:51:16.783Z",
    "dateUpdated": "2026-09-08T21:26:17.376Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-2786",
      "date": "2026-09-19",
      "epss": "0.00362",
      "percentile": "0.3007"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://github.com/grafana/tempo-operator",
                "defaultStatus": "unaffected",
                "packageName": "tempo-operator",
                "versions": [
                  {
                    "lessThan": "0.15.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
                ],
                "defaultStatus": "affected",
                "packageName": "rhosdt/tempo-rhel8-operator",
                "product": "Red Hat OpenShift distributed tracing 3.5.3",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "rhosdt-3.5-1743162265",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://catalog.redhat.com/software/containers/",
                "cpes": [
                  "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
                ],
                "defaultStatus": "affected",
                "packageName": "rhosdt/tempo-rhel8-operator",
                "product": "Red Hat OpenShift distributed tracing 3.5.3",
                "vendor": "Red Hat",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "unaffected",
                    "version": "rhosdt-3.5-1744028971",
                    "versionType": "rpm"
                  }
                ]
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift_distributed_tracing:3"
                ],
                "defaultStatus": "affected",
                "packageName": "rhosdt/tempo-gateway-opa-rhel8",
                "product": "Red Hat OpenShift distributed tracing 3",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift_distributed_tracing:3"
                ],
                "defaultStatus": "affected",
                "packageName": "rhosdt/tempo-gateway-rhel8",
                "product": "Red Hat OpenShift distributed tracing 3",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift_distributed_tracing:3"
                ],
                "defaultStatus": "affected",
                "packageName": "rhosdt/tempo-jaeger-query-rhel8",
                "product": "Red Hat OpenShift distributed tracing 3",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift_distributed_tracing:3"
                ],
                "defaultStatus": "affected",
                "packageName": "rhosdt/tempo-query-rhel8",
                "product": "Red Hat OpenShift distributed tracing 3",
                "vendor": "Red Hat"
              },
              {
                "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                "cpes": [
                  "cpe:/a:redhat:openshift_distributed_tracing:3"
                ],
                "defaultStatus": "affected",
                "packageName": "rhosdt/tempo-rhel8",
                "product": "Red Hat OpenShift distributed tracing 3",
                "vendor": "Red Hat"
              }
            ],
            "source": "secalert@redhat.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users\u0027 permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks."
          },
          {
            "lang": "es",
            "value": "Se detect\u00f3 una falla en Tempo Operator, que crea una cuenta de servicio, un rol de cl\u00faster y un enlace de rol de cl\u00faster cuando un usuario implementa una instancia de TempoStack o TempoMonolithic. Esta falla permite a un usuario con acceso completo a su espacio de nombres extraer el token de la cuenta de servicio y usarlo para enviar solicitudes TokenReview y SubjectAccessReview, lo que podr\u00eda revelar informaci\u00f3n sobre los permisos de otros usuarios. Si bien esto no permite la escalada de privilegios ni la suplantaci\u00f3n de identidad, expone informaci\u00f3n que podr\u00eda facilitar la recopilaci\u00f3n de informaci\u00f3n para futuros ataques."
          }
        ],
        "id": "CVE-2025-2786",
        "lastModified": "2026-09-08T22:17:36.290",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 1.4,
              "source": "secalert@redhat.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-2786",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T13:53:24.818603Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-04-02T11:15:39.300",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2025:3607"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHSA-2025:3740"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/security/cve/CVE-2025-2786"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354811"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://github.com/grafana/tempo-operator/pull/1145"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-200"
              }
            ],
            "source": "secalert@redhat.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-08T21:26:13+00:00",
      "cve": "CVE-2025-2786",
      "id": "CVE-2025-2786",
      "initial_release_date": "2025-03-25T00:00:00+00:00",
      "product_status:fixed": "8",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "tempo-operator: ServiceAccount Token Exposure Leading to Token and Subject Access Reviews in OpenShift Tempo Operator",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-2786.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-31T01:22:50Z",
      "cve": "CVE-2025-2786",
      "id": "CVE-2025-2786",
      "initial_release_date": "2026-07-31T01:22:50Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-2786",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-2786.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-2786",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-02T13:53:24.818603Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-02T13:53:32.587Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://github.com/grafana/tempo-operator",
              "defaultStatus": "unaffected",
              "packageName": "tempo-operator",
              "versions": [
                {
                  "lessThan": "0.15.3",
                  "status": "affected",
                  "version": "0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
              ],
              "defaultStatus": "affected",
              "packageName": "rhosdt/tempo-rhel8-operator",
              "product": "Red Hat OpenShift distributed tracing 3.5.3",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "rhosdt-3.5-1743162265",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
              ],
              "defaultStatus": "affected",
              "packageName": "rhosdt/tempo-rhel8-operator",
              "product": "Red Hat OpenShift distributed tracing 3.5.3",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "rhosdt-3.5-1744028971",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_distributed_tracing:3"
              ],
              "defaultStatus": "affected",
              "packageName": "rhosdt/tempo-gateway-opa-rhel8",
              "product": "Red Hat OpenShift distributed tracing 3",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_distributed_tracing:3"
              ],
              "defaultStatus": "affected",
              "packageName": "rhosdt/tempo-gateway-rhel8",
              "product": "Red Hat OpenShift distributed tracing 3",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_distributed_tracing:3"
              ],
              "defaultStatus": "affected",
              "packageName": "rhosdt/tempo-jaeger-query-rhel8",
              "product": "Red Hat OpenShift distributed tracing 3",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_distributed_tracing:3"
              ],
              "defaultStatus": "affected",
              "packageName": "rhosdt/tempo-query-rhel8",
              "product": "Red Hat OpenShift distributed tracing 3",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_distributed_tracing:3"
              ],
              "defaultStatus": "affected",
              "packageName": "rhosdt/tempo-rhel8",
              "product": "Red Hat OpenShift distributed tracing 3",
              "vendor": "Red Hat"
            }
          ],
          "datePublic": "2025-03-25T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users\u0027 permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-200",
                  "description": "Exposure of Sensitive Information to an Unauthorized Actor",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-08T21:26:17.376Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "name": "RHSA-2025:3607",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2025:3607"
            },
            {
              "name": "RHSA-2025:3740",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2025:3740"
            },
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2025-2786"
            },
            {
              "name": "RHBZ#2354811",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354811"
            },
            {
              "url": "https://github.com/grafana/tempo-operator/pull/1145"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2025-03-25T11:13:18.903Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2025-03-25T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator",
          "workarounds": [
            {
              "lang": "en",
              "value": "Currently, no mitigation is available for this vulnerability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2025-2786",
        "datePublished": "2025-04-02T11:07:43.285Z",
        "dateReserved": "2025-03-25T10:51:16.783Z",
        "dateUpdated": "2026-09-08T21:26:17.376Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.