OAuth Client Vulnerability in Hawtio Operator by Red Hat
CVE-2026-80219

8.7HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Apache Camel - Hawtio 4
Vendor
CVE Published:
8 September 2026

What is CVE-2026-80219?

A vulnerability was discovered in the Hawtio Operator that allows for the creation of a cluster-scoped OAuthClient with automatic grant approvals and no required client secret. When deployed in cluster mode, this flaw enables a malicious user to craft a misleading OAuth redirect URI leveraging tenant-controlled routing. By registering an arbitrary hostname, the attacker can mimic legitimate authorization requests, allowing them to capture OpenShift access tokens from users who visit the deceptive URL without any consent prompt, compromising the security of the entire cluster.

References

https://access.redhat.com/security/cve/CVE-2026-80219
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2524895
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.