CVE Alert: CVE-2026-77968 – Red Hat – Red Hat build of Apache Camel

A flaw was found in hawtio-operator. The operator’s ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators’ secrets.

High-risk Kubernetes control-plane exposure requiring prompt remediation; current enrichment indicates no known exploitation, but the potential impact is total compromise of sensitive cluster trust relationships.

A compromised operator workload could expose credentials and tokens held across namespaces, enabling access to cloud services, databases, CI/CD systems and other platform components. The changed scope means compromise could extend well beyond the application managed by HawtIO, while write permissions increase the risk of persistence or tampering. KEV status, PoC availability and EPSS are not provided, so exploitation likelihood remains uncertain.

### Most likely attack path

An attacker would first need network reachability to the cluster environment and low-level privileges sufficient to compromise or execute within the operator workload; no victim interaction is required. The high attack complexity suggests additional environmental or operational conditions, but once achieved, the service account’s permissions could provide cross-namespace access and support lateral movement through harvested credentials.

### Who is most exposed

Clusters running the operator with broad namespace coverage, valuable secrets, shared administration, or cloud-integrated workloads are most exposed. Risk is higher where operator namespaces permit broad developer access, pod execution, or weak isolation.

Audit API requests from the operator service account involving Secrets outside its expected namespaces.

Alert on operator pod exec, shell access, image changes or unexpected restarts.

Hunt for newly created or modified secrets attributed to that service account.

Correlate retrieved credentials with subsequent cloud, registry, CI/CD or workload logins.

### Mitigation and prioritisation

Apply the vendor-fixed release as a high-priority change; validate permissions after upgrade.

Treat as priority 1 if KEV status is confirmed true or EPSS is at least 0.5.

Restrict operator namespace access and remove unnecessary pod-exec permissions.

Apply least-privilege RBAC and NetworkPolicies limiting API and service egress.

Rotate potentially exposed secrets after containment, using staged change control to avoid workload disruption.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.