EUVD-2026-72694
GHSA-7xpg-hm9r-chmf
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
S:C reflects stolen OpenShift tokens granting access to the cluster API, a component outside hawtio-operator's trust boundary; PR:L and UI:R retained from vendor vector as accurate.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.
AnalysisAI
OpenShift access token theft in hawtio-operator's cluster-mode deployment allows a low-privileged tenant to hijack OAuth sessions of any cluster user. The operator creates a cluster-scoped OAuthClient configured as a public client (no secret) with automatic grant approval, and register redirect URIs derived from Routes whose hostnames are fully controlled via the Hawtio CR spec.routeHostName field. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the following concrete conditions: (1) hawtio-operator must be deployed in cluster mode (not namespace mode) on an OpenShift cluster, which triggers creation of the cluster-scoped OAuthClient with GrantMethod: auto; (2) the attacker must be an authenticated tenant with at least CREATE or PATCH RBAC permissions on Hawtio custom resources in some namespace - this is PR:L, not unauthenticated; (3) a victim cluster user must be social-engineered into clicking a crafted OAuth authorization URL (UI:R) - passive or automated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) reflects the realistic attack prerequisites accurately in several dimensions: PR:L correctly captures that a tenant must have CREATE or PATCH access to Hawtio CRs, and UI:R reflects the phishing requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade hawtio-operator to a patched release per the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-80219; a specific patched version number is not confirmed in the available data - monitor the advisory and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2524895 for the confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit current hawtio-operator deployments to identify cluster-mode instances and restrict RBAC permissions to prevent malicious Hawtio CR creation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wi
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary exte
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. W
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Same weakness CWE-1390 – Weak Authentication
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today