CVE-2026-80219
HighCVSS 8.7Summary
In hawtio-operator, when deploying Hawtio in cluster mode, a cluster-scoped OAuthClient is created with automatic grant approval and no client secret. Redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL.
Risk Assessment
Risk of unauthorized access to OpenShift tokens of cluster users, potentially leading to account takeover and privilege escalation within the cluster.
Recommendation
Recommend changing the OAuthClient configuration to require user consent (e.g., GrantMethod: prompt) and restricting the ability to set the routeHostName field by tenants.
Other vulnerabilities in hawtio-operator
See all- CVE-2026-77968High
In hawtio-operator, the ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Although the operator uses a label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.
- CVE-2026-78234Critical
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
Original NVD description (English source)
A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.