What’s Vulnerable › Vulnerabilities

CVE-2026-77968: Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-08 · updated 2026-09-08
• Weakness: CWE-269

Description

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.

Affected products

• Red Hat build of Apache Camel - HawtIO 4: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-77968
• https://bugzilla.redhat.com/show_bug.cgi?id=2524896

Get alerted when CVE-2026-77968 or the next vulnerability affects your stack