EUVD-2026-72692
GHSA-r6x8-cqxr-wwp4
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Pod-compromise prerequisite supports AC:H; cluster-wide secret read drives C:H/S:C; I:L not I:H since primary described impact is read access, not secret manipulation.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.
AnalysisAI
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wide Secret exposure. The operator's ServiceAccount is granted secrets: [create, get, list, update, watch] across all Kubernetes namespaces with no scope restriction, meaning an attacker who gains code execution in the operator pod can immediately read every Secret in the cluster - bootstrap tokens, cloud provider credentials, and secrets belonging to other operators. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two prerequisites must both be satisfied: first, the attacker must achieve code execution within the hawtio-operator pod through a separate vulnerability (such as a flaw in the hawtio application, a container escape, or a supply-chain compromise of the operator image); second, hawtio-operator must be deployed in the target Kubernetes cluster with its default ClusterRole configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, score 8.2) is broadly sound but the I:H metric warrants scrutiny: the primary described impact is confidential Secret read access; the create/update verbs in the ClusterRole do theoretically enable Secret manipulation, making I:H defensible but not the headline risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-77968 for a patched operator release; no specific fixed version is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all hawtio-operator deployments to identify which namespaces run the operator and confirm they are using default ClusterRole permissions; document all secrets managed within the cluster. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
OpenShift access token theft in hawtio-operator's cluster-mode deployment allows a low-privileged tenant to hijack OAuth
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary exte
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. W
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today