CVE-2025-2786 Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.15.3",
        "versionType": "semver"
      }
    ],
    "packageName": "tempo-operator",
    "collectionURL": "https://github.com/grafana/tempo-operator",
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift distributed tracing 3.5.1",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhosdt/tempo-rhel8-operator",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "sha256:233132300a9f5f019047a414b240f5b32c7563af8107bb52c4395892fdcd0fe0",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift distributed tracing 3.5.1",
    "collectionURL": "https://catalog.redhat.com/software/containers/",
    "packageName": "rhosdt/tempo-rhel8-operator",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "sha256:be2ec2e3d3b21748cfe3b9382f7fc1f6c72d5f380fc97773518c254c6e5794ca",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift distributed tracing 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhosdt/tempo-gateway-opa-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_distributed_tracing:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift distributed tracing 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhosdt/tempo-gateway-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_distributed_tracing:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift distributed tracing 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhosdt/tempo-jaeger-query-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_distributed_tracing:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift distributed tracing 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhosdt/tempo-query-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_distributed_tracing:3"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenShift distributed tracing 3",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "rhosdt/tempo-rhel8",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openshift_distributed_tracing:3"
    ]
  }
]