CVE-2026-80219

CVE-2026-80219 is a weak-authentication flaw (CWE-1390) in hawtio-operator: when Hawtio is deployed in cluster mode on OpenShift, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret, i.e. a public client. Because the redirect URI hostname is tenant-controlled via the Hawtio CR spec.routeHostName field, a malicious tenant can register an arbitrary hostname as a valid redirect target and craft a malicious authorization URL. Any cluster user who visits that URL is granted access silently with no consent prompt, letting the attacker steal that user's OpenShift access token and act with the victim's permissions on the cluster. Only environments running the Hawtio operator in cluster mode on multi-tenant OpenShift clusters, where untrusted tenants can influence routeHostName, are affected. No public proof of concept, CISA KEV listing, or known exploitation exists; EPSS estimates only about a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade hawtio-operator to a fixed release per the Red Hat advisory once published (no fixed version is given in the available data). Until patched, restrict which tenants may set spec.routeHostName in the Hawtio CR, set an explicit trusted redirect hostname, and avoid cluster mode on untrusted multi-tenant clusters. After upgrading, audit existing cluster-scoped OAuthClients for GrantMethod: auto with tenant-controlled redirect URIs and delete them so the operator recreates them with safe settings.