CVE-2026-77968
HighCVSS 8.2Summary
In hawtio-operator, the ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Although the operator uses a label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.
Risk Assessment
Risk of full disclosure of cluster secrets after compromise of the operator pod, potentially leading to cluster takeover and access to cloud credentials.
Recommendation
Recommend restricting ClusterRole permissions to the minimum required, e.g., only read access to secrets in specific namespaces, and avoiding direct API calls that bypass the cache.
Other vulnerabilities in hawtio-operator
See all- CVE-2026-80219High
In hawtio-operator, when deploying Hawtio in cluster mode, a cluster-scoped OAuthClient is created with automatic grant approval and no client secret. Redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL.
- CVE-2026-78234Critical
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
Original NVD description (English source)
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.