EUVD-2026-78275
GHSA-mc7v-mpqr-364j
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Network via OpenShift API, low complexity; PR:L for namespace edit; UI:R because OAuth token theft requires victim to follow crafted redirect; no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.
AnalysisAI
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary externally-routable Route hostnames that would normally require elevated cluster permissions. The operator holds a cluster-wide routes/custom-host:create privilege and blindly propagates the tenant-controlled spec.routeHostName field from Hawtio custom resources into OpenShift Route specs without validating whether the requesting user is authorized to claim that hostname. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an OpenShift cluster with hawtio-operator deployed and granted cluster-wide routes/custom-host:create permission; (2) the attacker holds namespace edit-level access (PR:L) sufficient to create or modify Hawtio custom resources in at least one namespace; (3) for the full C:H OAuth token theft scenario, the OAuthClient associated with Hawtio must have auto-grant enabled and a victim user must follow the crafted OAuth redirect flow (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.3 score with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N reflects a network-accessible, low-complexity attack requiring only namespace edit access (PR:L) but needing victim interaction (UI:R) for the full OAuth token theft scenario. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix availability is not independently confirmed from the provided references - the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-81303 should be consulted for patch status and exact fix versions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
OpenShift access token theft in hawtio-operator's cluster-mode deployment allows a low-privileged tenant to hijack OAuth
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wi
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. W
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today