CVE Feed

    Dashboard / CVE / CVE-2026-77968

    CVE-2026-77968

    A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.

    Published:Sep 8, 2026
    Last Modified:Sep 8, 2026
    EPS:Sep 8, 2026
    EPSS Score:
    CVSS Score:8.2

    Affected Products

    Vendor
    Redhat
    Product
    Apache Camel Hawtio

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-78234 (CVSS 9.9) — A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the …
    CVE-2026-80219 (CVSS 7.3) — A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-sco…
    CVE-2026-5680 (CVSS 7.5) — A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted …
    CVE-2026-14180 (CVSS 5.3) — A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss …
    CVE-2026-28369 (CVSS 8.7) — A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with o…
    CVE-2026-28367 (CVSS 8.7) — A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header…
    CVE-2026-28368 (CVSS 8.7) — A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted reque…
    CVE-2025-12543 (CVSS 9.6) — A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applica…
    CVE-2024-3884 (CVSS 7.5) — A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEnc…
    CVE-2025-9784 (CVSS 7.5) — A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without tri…

    References

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High