CVE-2026-77968

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Hawtio Operator via Secret Access

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: redhat-SADP

Description

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-08

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-77968

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	hawtio_operator	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in the hawtio-operator. The operator's ClusterRole grants excessive permissions to secrets across all namespaces. The ServiceAccount token allows reading every Secret in the cluster, including sensitive data like bootstrap tokens and cloud credentials. The operator bypasses its own cache via direct API calls, meaning a compromised operator pod could expose all cluster secrets.

Impact Analysis

If an attacker compromises the hawtio-operator pod, they could read all Secrets in the cluster. This includes sensitive information like credentials, tokens, and configuration data. This could lead to unauthorized access, data breaches, or further attacks within the cluster.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal or financial penalties.

Mitigation Strategies

Restrict the ClusterRole permissions to only necessary namespaces or secrets. Review and modify the operator's ServiceAccount token to limit access to Secrets. Monitor the operator pod for unauthorized access or unusual activity.

Hi! I’m here to help you understand CVE-2026-77968. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70