CVE-2026-77968
Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount
- State
- Published
- Severity
- 8.2 High
- Published
- Sep 8, 2026
- Updated
- Sep 8, 2026
- Reserved
- Aug 27, 2026
Description
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.2 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N | redhat |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
Red Hat build of Apache Camel - HawtIO 4Red Hat | |
Red Hat build of Apache Camel - HawtIO 4Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-77968vdb-entry
- RHBZ#2524896issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.