EUVD-2026-78276
GHSA-75j7-xvw4-g5cm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
AV:N because pod logs are read via the Kubernetes API over the network; AC:H because exploitation requires both custom TLS route and debug logging enabled simultaneously.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object - including the TLS private key in PEM format - is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.
AnalysisAI
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. When a custom Route TLS secret is configured and debug logging is set to level 1 or higher, the operator serializes the complete Route object - including the TLS private key in PEM format - to its standard output. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific configuration conditions must both be present: (1) a custom Route TLS secret must be configured in the hawtio-operator deployment - the default Hawtio installation without a custom TLS Route is not affected; and (2) the operator's log level must be set to 1 or higher (debug mode). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 5.5 (Medium), but the AV:L designation understates exposure in practice: Kubernetes pod logs are readable over the API server from any authenticated principal with a pods/log ClusterRole binding, making the effective attack surface network-accessible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade to a patched version of hawtio-operator once Red Hat releases a fix; monitor the advisory at https://access.redhat.com/security/cve/CVE-2026-81320 for patch availability, as no specific fixed version is confirmed in the current data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
OpenShift access token theft in hawtio-operator's cluster-mode deployment allows a low-privileged tenant to hijack OAuth
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wi
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary exte
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today