Important: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release

Red Hat OpenShift distributed tracing platform Tempo 3.11.0 has been released This release of the Red Hat OpenShift distributed tracing platform Tempo provides new features, security improvements, and bug fixes. Breaking changes: High availability defaults for TempoStack deployment sizes: Before...

CVE-2026-82751

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

CVE-2026-82750 Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. When the server sponsors...

EEF-CVE-2026-82750 Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation

Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. When the server...

EEF-CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server...

CVE-2026-82751

CVE-2026-82751 affects the ZenHive mpp library (Elixir), specifically MPP.Methods.Tempo.FeePayerPolicy.measure/3, in versions 0.2.0 through 0.16.0 . The function bounds gas fields, fee budgets, validity windows, and access lists of the client-signed 0x76 envelope but fails to check the optional k...

CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

CVE-2026-82751 Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for provisioning an access key on the client's own account. When the server sponsor...

GHSA-8WV5-X4W7-5GWW vulnerabilities

Vulnerabilities for packages: temporal, datadog-agent, bento, telegraf, amazon-cloudwatch-agent, tempo, wavefront-proxy, nri-kafka, zipkin, jaeger, minio, nri-jmx, nri-cassandra, jitsucom-bulker, seaweedfs, grafana...

CVE-2026-43871 vulnerabilities

Vulnerabilities for packages: temporal, datadog-agent, bento, telegraf, amazon-cloudwatch-agent, tempo, wavefront-proxy, nri-kafka, zipkin, jaeger, minio, nri-jmx, nri-cassandra, jitsucom-bulker, seaweedfs, grafana...

GO-2026-6325 Grafana Tempo vulnerable to an out-of-memory crash in github.com/grafana/tempo

Grafana Tempo vulnerable to an out-of-memory crash in github.com/grafana/tempo...

CLEANSTART-2026-RV68854 Security fixes in tempo 2.10.8-r2

Package tempo version 2.10.8-r2 fixes 1 vulnerabilities: CVE-2026-73500...

CLEANSTART-2026-IU41581 Security fixes in tempo 3.0.3-r1

Package tempo version 3.0.3-r1 fixes 1 vulnerabilities: CVE-2026-46600...

CLEANSTART-2026-JC77975 Security fixes in tempo 2.10.8-r1

Package tempo version 2.10.8-r1 fixes 2 vulnerabilities: CVE-2026-46600, ghsa-259r-337f-4rfw...

CLEANSTART-2026-ER95870 Security fixes in tempo 2.9.5-r2

Package tempo version 2.9.5-r2 fixes 1 vulnerabilities: ghsa-259r-337f-4rfw...

CLEANSTART-2026-QO69280 Security fixes in tempo 2.9.5-r1

Package tempo version 2.9.5-r1 fixes 2 vulnerabilities: CVE-2026-46600, ghsa-259r-337f-4rfw...

GO-2026-6258 vulnerabilities

Vulnerabilities for packages: cortex-geomys-fips, cortex-fips, thanos-fips, thanos-receive-controller-fips, tempo, thanos, thanos-receive-controller, cortex, pulumi-language-yaml, tempo-fips...

CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...

CVE-2026-73136

CVE-2026-73136 is an authentication bypass by capture-replay in ZenHive mpp (versions 0.6.1 before 0.6.4), affecting the MPP.Methods.Tempo payment verification component. When a static "memo" is configured in method_config, the function check_matched_memo_binding/3 returns a match unconditionally...

CVE-2026-73136 Static memo configuration in mpp Tempo disables per-challenge attribution binding, enabling third-party replay

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an unrelated payer. MPP.Methods.Tempo normally binds a settled TIP-20 TransferWithMemo to the specific challenge under verification through an...