Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80219— Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft

Quick assessment

Affected
Red Hat Red Hat build of Apache Camel - HawtIO 4
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

hawtio-operator 中发现了一个缺陷。在集群模式下部署 Hawtio 时，该操作员会创建一个集群作用域的 OAuthClient，其授权方式为自动批准（GrantMethod: auto），且不包含客户端密钥（即公共客户端）。重定向 URI 源自操作员创建的 Route，其主机名可通过 Hawtio CR 中的 字段由租户控制。恶意租户可以将任意主机名注册为有效的 OAuth 重定向目标，并且由于授权是自动批准的，任何访问该构造好的授权 URL 的集群用户都将无需同意提示即可被获取其 OpenShift

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1531 · Account Access Removal

Affected Version Matrix 2

VendorProduct Version RangeStatus
Red Hat Red Hat build of Apache Camel - HawtIO 4 any affected
any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80219

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1390
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat build of Apache Camel - HawtIO 4 - cpe:/a:redhat:apache_camel_hawtio:4
Red Hat Red Hat build of Apache Camel - HawtIO 4 - cpe:/a:redhat:apache_camel_hawtio:4

II. Public POCs for CVE-2026-80219

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80219

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-80219 (1)

Other References for CVE-2026-80219 (1)

Same Patch Batch · Red Hat · 2026-09-08 · 8 CVEs total

CVE-2026-78234 9.9 CRITICAL Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificat
CVE-2026-74860 8.5 HIGH Libxml2: double-free/uaf in libxml2 python bindings
CVE-2026-77968 8.2 HIGH Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serv
CVE-2026-76561 7.2 HIGH Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile con
CVE-2026-74859 6.8 MEDIUM Gnome-tweaks: path traversal in theme installer
CVE-2026-18090 6.1 MEDIUM Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block
CVE-2026-86564 3.3 LOW Dpdk: dpdk: missing length validation before reading command_data in virtio-net control qu

IV. Related Vulnerabilities

Same product: Red Hat build of Apache Camel - HawtIO 4
Same vendor: Red Hat
Same weakness: CWE-1390

V. Comments for CVE-2026-80219

No comments yet

Leave a comment