Red Hat Build Of Apache Camel Hawtio 4
Monthly
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache Camel - Hawtio 4) lets any authenticated user holding namespace 'edit' rights obtain an OpenShift Service-CA-signed client certificate with an attacker-chosen Subject CN. Because the operator reads the Service CA private signing key and mints certificates using a CN supplied in a namespaced Hawtio custom resource - and its ClusterRole aggregates Hawtio CR permissions into the standard edit/admin roles - a low-privileged tenant can forge a certificate that impersonates arbitrary in-cluster service identities (e.g. Jolokia agents) to any component trusting the Service CA for client authentication. No public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 9.9 rating and low attack barrier make it a high-priority patching target.
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wide Secret exposure. The operator's ServiceAccount is granted secrets: [create, get, list, update, watch] across all Kubernetes namespaces with no scope restriction, meaning an attacker who gains code execution in the operator pod can immediately read every Secret in the cluster - bootstrap tokens, cloud provider credentials, and secrets belonging to other operators. No public exploit code has been identified at time of analysis, but the vulnerability is a structural privilege misconfiguration that persists for the lifetime of any deployment running the default ClusterRole.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. When a custom Route TLS secret is configured and debug logging is set to level 1 or higher, the operator serializes the complete Route object - including the TLS private key in PEM format - to its standard output. Because operator logs are routinely aggregated into centralized logging platforms and are accessible to any principal holding pods/log access in the openshift-operators namespace, this creates a pathway for credential exfiltration without direct secret access. No public exploit code exists and this CVE is not in CISA KEV, but the low debug threshold (level 1) means the exposure is frequently triggered during normal troubleshooting workflows.
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary externally-routable Route hostnames that would normally require elevated cluster permissions. The operator holds a cluster-wide `routes/custom-host:create` privilege and blindly propagates the tenant-controlled `spec.routeHostName` field from Hawtio custom resources into OpenShift Route specs without validating whether the requesting user is authorized to claim that hostname. The captured subdomain can then be combined with the cluster's auto-grant OAuthClient to hijack OAuth redirect flows and steal tokens from legitimate users (PR:L, UI:R, C:H, CVSS 6.3). No public exploit code has been identified at time of analysis.
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-sync requests, bypassing upstream security controls such as authentication layers or reverse-proxy ACLs. Affected deployments include JBoss EAP 7, WildFly, Red Hat Enterprise Linux 8/9/10, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Single Sign-On 7, and several Apache Camel-based Red Hat products. No confirmed active exploitation or public proof-of-concept has been identified at time of analysis; the CVSS 5.3 Medium score reflects limited direct impact, though real-world risk in proxy-fronted architectures is meaningfully higher than the score alone suggests.
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/form-data content to trigger premature parsing and disk storage of request data, leading to Denial of Service when applications use parameter retrieval methods like getParameterMap(). The vulnerability affects multiple Red Hat products including Enterprise Linux 8, 9, and 10, JBoss Enterprise Application Platform 7 and 8, Red Hat Fuse 7, and several Apache Camel variants. An attacker with network access and no authentication can exhaust server disk resources with moderate attack complexity, causing service unavailability.
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache Camel - Hawtio 4) lets any authenticated user holding namespace 'edit' rights obtain an OpenShift Service-CA-signed client certificate with an attacker-chosen Subject CN. Because the operator reads the Service CA private signing key and mints certificates using a CN supplied in a namespaced Hawtio custom resource - and its ClusterRole aggregates Hawtio CR permissions into the standard edit/admin roles - a low-privileged tenant can forge a certificate that impersonates arbitrary in-cluster service identities (e.g. Jolokia agents) to any component trusting the Service CA for client authentication. No public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 9.9 rating and low attack barrier make it a high-priority patching target.
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wide Secret exposure. The operator's ServiceAccount is granted secrets: [create, get, list, update, watch] across all Kubernetes namespaces with no scope restriction, meaning an attacker who gains code execution in the operator pod can immediately read every Secret in the cluster - bootstrap tokens, cloud provider credentials, and secrets belonging to other operators. No public exploit code has been identified at time of analysis, but the vulnerability is a structural privilege misconfiguration that persists for the lifetime of any deployment running the default ClusterRole.
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to exhaust server memory by sending specially crafted compressed WebSocket messages. The root cause is exponential buffer doubling in the PerMessageDeflateFunction.largerBuffer() method (CWE-770), which triggers unbounded memory allocation with no confirmation of active exploitation at time of analysis. Affected deployments span a broad Red Hat ecosystem including JBoss EAP 7/8, Red Hat Data Grid 8, Apache Camel for Spring Boot 4, and RHEL 8/9/10 packages that bundle Undertow.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
JVM memory exhaustion in the wildfly-elytron-asn1 DERDecoder allows unauthenticated remote attackers to exhaust heap on any service that feeds untrusted DER/ASN.1 bytes into the library, notably SASL authentication flows and X.500 certificate principal parsing. The decoder reads an attacker-supplied length value and attempts a corresponding allocation without validating it against the actual remaining input, so a crafted payload can force an oversized allocation and destabilize or crash the JVM (availability impact only, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/C:N/I:N/A:H, CWE-770). Exploitation is opportunistic rather than deterministic because the AC:H rating means success depends on payload size/repetition relative to the victim's configured heap, and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV and no EPSS score was provided. Scope is limited to Red Hat products that bundle the affected elytron-asn1 library, including Red Hat Build of Keycloak, JBoss EAP 7/8 (and EAP XP), Red Hat Single Sign-On 7, Fuse 7, Quarkus, Data Grid 8, Camel, Debezium, and Cryostat.
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. When a custom Route TLS secret is configured and debug logging is set to level 1 or higher, the operator serializes the complete Route object - including the TLS private key in PEM format - to its standard output. Because operator logs are routinely aggregated into centralized logging platforms and are accessible to any principal holding pods/log access in the openshift-operators namespace, this creates a pathway for credential exfiltration without direct secret access. No public exploit code exists and this CVE is not in CISA KEV, but the low debug threshold (level 1) means the exposure is frequently triggered during normal troubleshooting workflows.
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary externally-routable Route hostnames that would normally require elevated cluster permissions. The operator holds a cluster-wide `routes/custom-host:create` privilege and blindly propagates the tenant-controlled `spec.routeHostName` field from Hawtio custom resources into OpenShift Route specs without validating whether the requesting user is authorized to claim that hostname. The captured subdomain can then be combined with the cluster's auto-grant OAuthClient to hijack OAuth redirect flows and steal tokens from legitimate users (PR:L, UI:R, C:H, CVSS 6.3). No public exploit code has been identified at time of analysis.
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-sync requests, bypassing upstream security controls such as authentication layers or reverse-proxy ACLs. Affected deployments include JBoss EAP 7, WildFly, Red Hat Enterprise Linux 8/9/10, Red Hat Data Grid 8, Red Hat Fuse 7, Red Hat Single Sign-On 7, and several Apache Camel-based Red Hat products. No confirmed active exploitation or public proof-of-concept has been identified at time of analysis; the CVSS 5.3 Medium score reflects limited direct impact, though real-world risk in proxy-fronted architectures is meaningfully higher than the score alone suggests.
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/form-data content to trigger premature parsing and disk storage of request data, leading to Denial of Service when applications use parameter retrieval methods like getParameterMap(). The vulnerability affects multiple Red Hat products including Enterprise Linux 8, 9, and 10, JBoss Enterprise Application Platform 7 and 8, Red Hat Fuse 7, and several Apache Camel variants. An attacker with network access and no authentication can exhaust server disk resources with moderate attack complexity, causing service unavailability.