Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-81320

Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

CVSS 3.1 5.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-81320

Published

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-81320

Published

rhbac-4/hawtio-rhel9

https://access.redhat.com/downloads/content/package-browser/

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Red Hat",
                    "product": "Red Hat build of Apache Camel - HawtIO 4",
                    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
                    "packageName": "rhbac-4/hawtio-rhel9",
                    "defaultStatus": "affected",
                    "cpes": [
                        "cpe:/a:redhat:apache_camel_hawtio:4"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON