OAuth Redirect URI Tampering in hawtio-operator Cluster Mode
CVE-2026-80219 Published on September 8, 2026
Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft
A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.
Vulnerability Analysis
CVE-2026-80219 can be exploited with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Timeline
Reported to Red Hat.
Made public. 111 days later.
Weakness Type
Products Associated with CVE-2026-80219
Want to know whenever a new CVE is published for Red Hat Apache Camel Hawtio? stack.watch will email you.
