Vulnerability details
CVE-2026-77968
Red Hat build of Apache Camel - HawtIO 4
Hawtio-operator: hawtio-operator: cluster-wide secrets read/write granted to operator serviceaccount
CVSS 3.1
8.2High
Official description
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 3.1 | CVEProject cvelistV5 (CNA) (redhat) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | All | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://access.redhat.com/security/cve/CVE-2026-77968 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2524896 issue-trackingx_refsource_REDHAT
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-08
- Last updated
- 2026-09-08
- State
- Published
- Assigner (CNA)
- redhat
Exploit prediction (EPSS)
0.42%
Probability of exploitation in 30 days
36.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-269Improper Privilege Management