CVE-2025-2786
CVE-2025-2786: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium4.3
Medium [CVE-2025-2786] serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator
CVE-2025-2786Source published Source updated
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview and SubjectAccessReview requests, potentially revealing information about other users' permissions. While this does not allow privilege escalation or impersonation, it exposes information that could aid in gathering information for further attacks. Red Hat has evaluated this vulnerability and rated with a Moderate impact as the attacker is limited to read access and requires previous permissions to read the token and get access to the cluster metrics. Red Hat severity: Moderate — CVSS 4.3…
- Affected products in this advisory
- Red Hat OpenShift distributed tracing 3.5.2
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- rhosdt/tempo-rhel8-operator:rhosdt-3.5-1743162265
- rhosdt/tempo-rhel8-operator:rhosdt-3.5-1744028971
- RHSA-2025:3607
- RHSA-2025:3740
- Mitigation guidance
- Currently, no mitigation is available for this vulnerability.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.