Description
A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator creates a ClusterRoleBinding for the Service Account of the Tempo instance to grant the cluster-monitoring-view ClusterRole. This can be exploited if a user has 'create' permissions on TempoStack and 'get' permissions on Secret in a namespace (for example, a user has ClusterAdmin permissions for a specific namespace), as the user can read the token of the Tempo service account and therefore has access to see all cluster metrics.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
tempo-operator
Default version status: unaffected
0 to < 0.15.3affected
Red Hat Red Hat OpenShift distributed tracing 3.5.3
Default version status: affected
rhosdt-3.5-1743162265 to < *unaffected
Red Hat Red Hat OpenShift distributed tracing 3.5.3
Default version status: affected
rhosdt-3.5-1744028971 to < *unaffected
Red Hat Red Hat OpenShift distributed tracing 3
Default version status: affected
Red Hat Red Hat OpenShift distributed tracing 3
Default version status: affected
Red Hat Red Hat OpenShift distributed tracing 3
Default version status: affected
Red Hat Red Hat OpenShift distributed tracing 3
Default version status: affected
Red Hat Red Hat OpenShift distributed tracing 3
Default version status: affected