RHSA-2026:88187HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.3 release

Published
October 22, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (2)

CVE-2026-108859 →CVE-2026-111943 →

📋 Description

CVE-2026-108859 — github.com/mark3labs/mcp-go: mcp-go: Denial of Service via unbounded HTTP request body buffering CVE-2026-111943 — crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates

🎯 Affected products26

  • Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:92026ec0560a465c05e285977c77bd4761f118a3ac2cb472e31c723d4d501d04_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:abd3f80e68912485fdfb5b382f5886af8569ddf037824d64e19a137f5cd865ef_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:c8dd50e5afa16d81b7489805589d5515ae6b2c8b745b95f58381f2d04d45e6c5_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:e19d95b90ef76594d56791c85587c3c92f86f880e4517e6913fca2edf7bee430_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:8820adea0a78175001803e4f4f102fbaa706959d963a32ab3a7f654e066cf73c_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:88c6450188c013d8c4230e75f3d5bf1e6068a84483ca64ab431aabf6b986ff61_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:a332750c6d7b9a74749b2dec8861b986bf06d05c869b2cf5223c50f9216f0763_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:fb6bd2afe9d280a29fcb1bee4da5d85ada4d5e5b5193c4bdb8424e3dc5f45d6c_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:34f32a65dba4fba0728b630b49bb4071375eb765d53a84a1593751b4d5709880_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:4f6bfa54ff0642e3366990a3427e26d2ce520e41bccb44c9291e37715572fefb_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:75d1a267305e36a2f80c257180e6f7e3f427c056cd63b9b167afc6b3138ab944_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d98f66d5415a5ea6d05ca0a2adadcf64cfcff5f0535bdf73e5ea943489d63a70_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:a33974d5850474d2f7fbb84389a99f04679cf8fcfcea7a03d455aa9026448e13_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:347c0ae905b7ca2ce09ff1ba087fbcbf1dc1c3ed8ac5b82fac4e87b732f3ad06_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:675c58075ffa273b2a6bb78ce399a002edf1a995e7a399d959a8f4c3679c1f1d_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:b9b38242740170590a4adfc0bbe02428e65940f60c76116249f6cbdcbeb7ee6c_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:dc92afea74b2afb28a0b9f27123e7416db3eac89346b0054d09c407f504d56d9_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:3a6cdb86a67fd6708f937bac3f97917fa92abfe291951c33a14601b7acde36f8_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:7f7ee660db5135ba01e9b7de437c73b10d5baf83480ec07fd11861520929f2e3_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc88d94bff554a1c8cc2ed671648854dbf0729fe0994b160b8b0536888c847ef_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:f917c2bd65b16337d59f414e0e621762ae870142034bf7672fad34f5433fbab3_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:12a1d493d34e0396283ab234f664849660ba06c2cd650b72e10676b02d83f0e5_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:343fb622b86271cde9d5c5c2fd9b9ed6765bac13cb0ab251649b3029df30a0d9_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:5a667ccd58c083b562a159aeb6476dbec3136258c74c5fa43eed5322de95fc47_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:b585a15d886cec86d2b36a5b4ab763730f666ba59145fbc716f023280685a619_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: Restrict network exposure of the affected service to trusted clients or place it behind an intermediate reverse proxy or ingress controller that enforces strict HTTP request body size limits. 1. Firewall configuration (for standalone host deployments): Limit access to the listening port to trusted subnets: ``` firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR> firewall-cmd --reload ``` 2. OpenShift / Kubernetes environments: Apply an OpenShift NetworkPolicy to restrict ingress traffic targeting the affected pods exclusively to authorized namespaces or ingress components. Additionally, configure ingress controllers or reverse proxies to limit maximum client request body sizes, dropping oversized POST requests before they reach backend services. Caveats: Restricting access to trusted networks will prevent unauthorized or external clients from accessing the service. Setting strict payload thresholds at the proxy layer may reject legitimate client requests that exceed the defined maximum size. Warning: Running `firewall-cmd --reload` reloads active firewall configurations and can temporarily disrupt existing network connections. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (6)