Vulnerability-Lookup

RHSA-2026:66120

Vulnerability from csaf_redhat - Published: 2026-09-09 21:28 - Updated: 2026-09-10 03:34

Summary

Red Hat Security Advisory: Updated Container Images: HawtIO 4.4.1 for Red Hat build of Apache Camel 4 Release and security update.

Severity

Critical

Notes

Topic: Updated container images are now available

Details: The container images have been updated to address the following security advisory: RHSA-2026:42952 (see References) Users of container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images. You can find images updated by this advisory in Red Hat Container Catalog (see References).

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-269 - Improper Privilege Management

Affected products

Fixed 7 products

Product	Version	Remediation
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-78234

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-295 - Improper Certificate Validation

Affected products

Fixed 7 products

Product	Version	Remediation
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le	—	Vendor Fix fix Workaround

Threats

Impact Important

References

14 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:66120	self
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/errata/RHSA-2026:42952	external
https://catalog.redhat.com/en	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-77968	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524896	external
https://www.cve.org/CVERecord?id=CVE-2026-77968	external
https://nvd.nist.gov/vuln/detail/CVE-2026-77968	external
https://access.redhat.com/security/cve/CVE-2026-78234	self
https://bugzilla.redhat.com/show_bug.cgi?id=2524894	external
https://www.cve.org/CVERecord?id=CVE-2026-78234	external
https://nvd.nist.gov/vuln/detail/CVE-2026-78234	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated container images are now available",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The  container images have been updated to address the following security advisory: RHSA-2026:42952 (see References)\n\nUsers of  container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.\n\nYou can find images updated by this advisory in Red Hat Container Catalog (see References).",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:66120",
        "url": "https://access.redhat.com/errata/RHSA-2026:66120"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification#critical",
        "url": "https://access.redhat.com/security/updates/classification#critical"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/errata/RHSA-2026:42952",
        "url": "https://access.redhat.com/errata/RHSA-2026:42952"
      },
      {
        "category": "external",
        "summary": "https://catalog.redhat.com/en",
        "url": "https://catalog.redhat.com/en"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66120.json"
      }
    ],
    "title": "Red Hat Security Advisory: Updated Container Images: HawtIO 4.4.1 for Red Hat build of Apache Camel 4 Release and security update.",
    "tracking": {
      "current_release_date": "2026-09-10T03:34:43+00:00",
      "generator": {
        "date": "2026-09-10T03:34:43+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.18"
        }
      },
      "id": "RHSA-2026:66120",
      "initial_release_date": "2026-09-09T21:28:39+00:00",
      "revision_history": [
        {
          "date": "2026-09-09T21:28:39+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-09T21:28:39+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-10T03:34:43+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
                "product": {
                  "name": "Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
                  "product_id": "9Base-RHBOAC-HWT-4.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:apache_camel_hawtio:4.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Build of Apache Camel"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
                "product": {
                  "name": "rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
                  "product_id": "rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba?arch=s390x\u0026repository_url=registry.redhat.io/rhbac-4/hawtio-operator-bundle\u0026tag=2.0.1-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
                "product": {
                  "name": "rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
                  "product_id": "rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58?arch=s390x\u0026repository_url=registry.redhat.io/rhbac-4/hawtio-rhel9-operator\u0026tag=2.0.1-10"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
                "product": {
                  "name": "rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
                  "product_id": "rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250?arch=arm64\u0026repository_url=registry.redhat.io/rhbac-4/hawtio-operator-bundle\u0026tag=2.0.1-8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
                "product": {
                  "name": "rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
                  "product_id": "rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69?arch=amd64\u0026repository_url=registry.redhat.io/rhbac-4/hawtio-operator-bundle\u0026tag=2.0.1-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
                "product": {
                  "name": "rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
                  "product_id": "rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7?arch=amd64\u0026repository_url=registry.redhat.io/rhbac-4/hawtio-rhel9-operator\u0026tag=2.0.1-10"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
                "product": {
                  "name": "rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
                  "product_id": "rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbac-4/hawtio-operator-bundle\u0026tag=2.0.1-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le",
                "product": {
                  "name": "rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le",
                  "product_id": "rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4?arch=ppc64le\u0026repository_url=registry.redhat.io/rhbac-4/hawtio-rhel9-operator\u0026tag=2.0.1-10"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64 as a component of Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
          "product_id": "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64"
        },
        "product_reference": "rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
        "relates_to_product_reference": "9Base-RHBOAC-HWT-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x as a component of Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
          "product_id": "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x"
        },
        "product_reference": "rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
        "relates_to_product_reference": "9Base-RHBOAC-HWT-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64 as a component of Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
          "product_id": "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64"
        },
        "product_reference": "rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
        "relates_to_product_reference": "9Base-RHBOAC-HWT-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le as a component of Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
          "product_id": "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le"
        },
        "product_reference": "rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
        "relates_to_product_reference": "9Base-RHBOAC-HWT-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x as a component of Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
          "product_id": "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x"
        },
        "product_reference": "rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
        "relates_to_product_reference": "9Base-RHBOAC-HWT-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64 as a component of Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
          "product_id": "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64"
        },
        "product_reference": "rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
        "relates_to_product_reference": "9Base-RHBOAC-HWT-4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le as a component of Red Hat Build of Apache Camel HawtIO 4.4 for RHEL 9",
          "product_id": "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
        },
        "product_reference": "rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le",
        "relates_to_product_reference": "9Base-RHBOAC-HWT-4.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-77968",
      "cwe": {
        "id": "CWE-269",
        "name": "Improper Privilege Management"
      },
      "discovery_date": "2026-05-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524896"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in hawtio-operator. The operator\u0027s ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators\u0027 secrets.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hawtio-operator: hawtio-operator: Cluster-wide secrets read/write granted to operator ServiceAccount",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has determined that this vulnerability is Important severity. The hawtio-operator ServiceAccount has cluster-wide secrets read/write permissions that far exceed its operational needs. While exploitation requires prior compromise of the operator pod, the blast radius is the entire cluster\u0027s Secret corpus. Red Hat recommends scoping permissions to namespaced Roles created on demand for each Hawtio instance, with resourceNames restrictions for the Service CA secret.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77968"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524896",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524896"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77968",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77968"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77968",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77968"
        }
      ],
      "release_date": "2026-09-08T10:56:55.174000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T21:28:39+00:00",
          "details": "The  container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66120"
        },
        {
          "category": "workaround",
          "details": "Restrict access to the hawtio-operator namespace and limit who can exec into the operator pod. Monitor cluster audit logs for unexpected Secret access patterns from the hawtio-operator ServiceAccount. As a defence-in-depth measure, apply a NetworkPolicy to the operator namespace restricting egress to only the Kubernetes API server and required service endpoints.",
          "product_ids": [
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "hawtio-operator: hawtio-operator: Cluster-wide secrets read/write granted to operator ServiceAccount"
    },
    {
      "cve": "CVE-2026-78234",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-05-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2524894"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "hawtio-operator: hawtio-operator: Service-CA signing oracle allows arbitrary-CN certificate issuance to namespace edit users",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has determined that this vulnerability is Important severity and not Critical because authentication is required. The hawtio-operator directly reads the cluster Service CA private key and issues certificates with an attacker-controlled Common Name, effectively providing a signing oracle to any namespace editor. Exploitation enables cross-tenant service impersonation and, via Jolokia MBean invocation on Java workloads, remote code execution. Red Hat recommends that the operator stop reading the Service CA signing key and instead use the Kubernetes CSR API with a dedicated signer or a Hawtio-private CA.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
          "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-78234"
        },
        {
          "category": "external",
          "summary": "RHBZ#2524894",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524894"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-78234",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-78234"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-78234",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78234"
        }
      ],
      "release_date": "2026-09-08T10:55:10.366000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-09T21:28:39+00:00",
          "details": "The  container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.",
          "product_ids": [
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:66120"
        },
        {
          "category": "workaround",
          "details": "Do not set spec.routeHostName to values outside the operator\u0027s own namespace service names. Restrict which users can create or modify Hawtio custom resources via RBAC. Audit existing Hawtio CR instances for unexpected routeHostName values and rotate any TLS certificates that may have been issued with incorrect Common Names.",
          "product_ids": [
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:1d8ea1649ed820b4ccd88642da2d4893d235304bf555420c4cdac8f14143c250_arm64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:23dc542eed8e63eac9a44e3da09e94a6dd66b0525f5f4f43917c34ce528ad2ba_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:26ab39aa76637e98dd8a00bae0ca698abea3feccab48879f20f124bb4ce7cf69_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-operator-bundle@sha256:f36c63ce007002ef2d2f6fa4e0afeeab50d4b7ad4db3aec8646d1e0423c0411b_ppc64le",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:2370ba6b422e78f8154d299e907eeb1991ffd18dcb2e0f8959293b6adf072d58_s390x",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:5b0bbdfecc9abb44d9f61d37ace8589effbb3d941d552741900c7e0049459ec7_amd64",
            "9Base-RHBOAC-HWT-4.4:rhbac-4/hawtio-rhel9-operator@sha256:a44b50036d31bb34c2a8903a3aeb0db495bc0a4832103fb8bd7306fc1318ffa4_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "hawtio-operator: hawtio-operator: Service-CA signing oracle allows arbitrary-CN certificate issuance to namespace edit users"
    }
  ]
}

CVE-2026-77968 (GCVE-0-2026-77968)

Vulnerability from cvelistv5 – Published: 2026-09-08 11:27 – Updated: 2026-09-08 14:05

Title

Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

Summary

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 14:05 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

redhat redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-77968	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2524896	issue-trackingx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4

Date Public

2026-09-08 10:56

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T14:05:09.115190Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T14:05:23.465Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbac-4/hawtio-operator-bundle",
          "product": "Red Hat build of Apache Camel - HawtIO 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbac-4/hawtio-rhel9",
          "product": "Red Hat build of Apache Camel - HawtIO 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-09-08T10:56:55.174Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in hawtio-operator. The operator\u0027s ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators\u0027 secrets."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T11:27:49.823Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-77968"
        },
        {
          "name": "RHBZ#2524896",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524896"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-20T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-08T10:56:55.174Z",
          "value": "Made public."
        }
      ],
      "title": "Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount",
      "workarounds": [
        {
          "lang": "en",
          "value": "Restrict access to the hawtio-operator namespace and limit who can exec into the operator pod. Monitor cluster audit logs for unexpected Secret access patterns from the hawtio-operator ServiceAccount. As a defence-in-depth measure, apply a NetworkPolicy to the operator namespace restricting egress to only the Kubernetes API server and required service endpoints."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-269: Improper Privilege Management"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-77968",
    "datePublished": "2026-09-08T11:27:49.823Z",
    "dateReserved": "2026-08-27T10:25:52.077Z",
    "dateUpdated": "2026-09-08T14:05:23.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-78234 (GCVE-0-2026-78234)

Vulnerability from cvelistv5 – Published: 2026-09-08 11:27 – Updated: 2026-09-08 17:14

Title

Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users

Summary

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 12:18 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

redhat redhat root

References

2 references

URL	Tags
https://access.redhat.com/security/cve/CVE-2026-78234	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2524894	issue-trackingx_refsource_REDHAT

Impacted products

1 product

Vendor	Product	Version
Red Hat	Red Hat build of Apache Camel - HawtIO 4	cpe:/a:redhat:apache_camel_hawtio:4

Date Public

2026-09-08 10:55

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-78234",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T12:18:30.594248Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T12:19:06.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbac-4/hawtio-gateway-rhel9",
          "product": "Red Hat build of Apache Camel - HawtIO 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbac-4/hawtio-operator-bundle",
          "product": "Red Hat build of Apache Camel - HawtIO 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:apache_camel_hawtio:4"
          ],
          "defaultStatus": "affected",
          "packageName": "rhbac-4/hawtio-rhel9",
          "product": "Red Hat build of Apache Camel - HawtIO 4",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2026-09-08T10:55:10.366Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T17:14:44.894Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-78234"
        },
        {
          "name": "RHBZ#2524894",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524894"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-20T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-08T10:55:10.366Z",
          "value": "Made public."
        }
      ],
      "title": "Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not set spec.routeHostName to values outside the operator\u0027s own namespace service names. Restrict which users can create or modify Hawtio custom resources via RBAC. Audit existing Hawtio CR instances for unexpected routeHostName values and rotate any TLS certificates that may have been issued with incorrect Common Names."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-295: Improper Certificate Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-78234",
    "datePublished": "2026-09-08T11:27:52.787Z",
    "dateReserved": "2026-08-27T10:25:52.070Z",
    "dateUpdated": "2026-09-08T17:14:44.894Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:66120

CVE-2026-77968 (GCVE-0-2026-77968)

CVE-2026-78234 (GCVE-0-2026-78234)

Tags

Sightings

Nomenclature