Insufficiently Restricted Secrets Access in Hawtio Operator by Red Hat
CVE-2026-77968

8.2HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Apache Camel - Hawtio 4
Vendor
CVE Published:
8 September 2026

What is CVE-2026-77968?

A flaw exists in the Hawtio Operator where the ClusterRole provides excessive permissions to secrets across all namespaces. This configuration allows any compromised operator pod to access sensitive information, including bootstrap tokens and cloud credentials. The operator's use of a controller-runtime label-selector cache for memory optimization compromises security as it can bypass the cache through direct API calls, leading to unauthorized read access of critical secrets stored within the cluster.

References

https://access.redhat.com/security/cve/CVE-2026-77968
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2524896
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.