CVE-2025-2842
CVE-2025-2842: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium4.3
Medium [CVE-2025-2842] tempo operator token exposition lead to read sensitive data
CVE-2025-2842Source published Source updated
A flaw was found in the Tempo Operator. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics. Red Hat has evaluated this vulnerability and rated with a Moderate impact as the attacker is limited to read access and requires previous permissions to read the token and get access to the cluster metrics. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-200. Affected Red Hat products: Red Hat OpenShift distributed tracing 3.5.2; Red Hat OpenShift distributed tracing 3. Red Hat fixing advisory…
- Affected products in this advisory
- Red Hat OpenShift distributed tracing 3.5.2
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- rhosdt/tempo-rhel8-operator:rhosdt-3.5-1743162265
- rhosdt/tempo-rhel8-operator:rhosdt-3.5-1744028971
- RHSA-2025:3607
- RHSA-2025:3740
- Mitigation guidance
- Currently, no mitigation is available for this vulnerability.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.