Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-81303

Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname

CVSS 3.1 6.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-81303

Published

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-81303

Published

rhbac-4/hawtio-operator-bundle

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apache Camel - HawtIO 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhbac-4/hawtio-operator-bundle",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:apache_camel_hawtio:4"
                    ]
                }

rhbac-4/hawtio-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apache Camel - HawtIO 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhbac-4/hawtio-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:apache_camel_hawtio:4"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON