CVE Feed

    Dashboard / CVE / CVE-2026-81320

    CVE-2026-81320

    A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.

    Published:Sep 15, 2026
    Last Modified:Sep 17, 2026
    EPS:Sep 15, 2026
    EPSS Score:0.00135
    CVSS Score:5.5

    Affected Products

    Vendor
    Redhat
    Product
    Apache Camel Hawtio

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-215 Fuzzing for application mapping

    Related CVEs

    CVE-2026-10832 (CVSS 5.9) — A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resou…
    CVE-2026-81303 (CVSS 6.3) — A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and …
    CVE-2026-78234 (CVSS 9.9) — A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the …
    CVE-2026-77968 (CVSS 8.2) — A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, wa…
    CVE-2026-80219 (CVSS 8.7) — Red Hat Product Security has come to the conclusion that this CVE is not needed.…
    CVE-2026-5680 (CVSS 7.5) — A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted …
    CVE-2026-14180 (CVSS 5.3) — A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss …
    CVE-2026-28369 (CVSS 8.7) — A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with o…
    CVE-2026-28367 (CVSS 8.7) — A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header…
    CVE-2026-28368 (CVSS 8.7) — A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted reque…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High