Sensitive Data Exposure in Hawtio Operator by Red Hat

CVE-2026-81320

What is CVE-2026-81320?

A security vulnerability has been identified in the Hawtio Operator, where the configuration of a custom Route TLS secret leads to sensitive data exposure. When the operator operates with a debug log level of 1 or higher, it serializes the entire Route object, including the TLS private key in PEM format. This serialized data is then output to the operator's standard logs. Since these logs are often forwarded to centralized logging systems, anyone with access to the pod logs within the openshift-operators namespace can potentially view this sensitive information, posing a significant security risk, particularly in operational environments where debug logging is commonly used for troubleshooting.

References