CVE Alert: CVE-2026-80219 – Red Hat – Red Hat build of Apache Camel

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.

This is a high-priority identity-compromise risk for affected OpenShift clusters; KEV status, SSVC exploitation state and EPSS are not supplied, so threat-led urgency cannot be confirmed.

A tenant-controlled redirect destination combined with automatic authorisation can turn a normal user visit into theft of an OAuth token. An attacker could then act with the victim’s cluster permissions, potentially accessing secrets, workloads and administrative interfaces, with impact extending beyond the originating namespace.

### Most likely attack path

The attacker needs low-level access to create or influence the relevant tenant configuration, but exploitation is network-reachable, low complexity and requires the victim to follow a crafted link. User interaction is therefore the main practical barrier. Because Scope is changed, a compromised token may enable activity across cluster boundaries, subject to the victim’s privileges.

### Who is most exposed

Clusters allowing multiple tenants or teams to deploy Hawtio in cluster mode are most at risk, particularly shared development, integration and managed OpenShift environments. Exposure is higher where users commonly follow links from tenant dashboards, tickets or chat.

Review OAuth server audit logs for unexpected grants to the Hawtio client.

Alert on authorisation requests containing unapproved or newly registered redirect hosts.

Identify tokens issued immediately after visits to tenant-controlled routes.

Audit OAuthClient objects for automatic grant approval or missing client credentials.

Investigate cross-namespace API activity following suspicious authorisation events.

### Mitigation and prioritisation

Apply the vendor remediation at the earliest controlled change window; prioritise internet- or tenant-exposed clusters.

Until patched, require explicit consent and configure a strong client secret on each affected OAuthClient.

Restrict who may set route hostnames and validate them against an allow-list.

Revoke potentially exposed tokens and review their subsequent API activity.

KEV and EPSS values are unavailable; priority 1 cannot be confirmed without those feeds.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.