CVE-2026-81303
Received Received - Intake

Hawtio Operator Route Hostname Subdomain Takeover

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: redhat-SADP

Description
A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-16
AI Q&A
2026-09-15
EPSS Evaluated
2026-09-15
NVD
CVE-2026-81303
EUVD
EUVD-2026-78275

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat hawtio-operator *
red_hat hawtio_operator *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the hawtio-operator. The operator has excessive permissions to create routes with custom hostnames and directly uses tenant-supplied hostnames without validation or authorization checks. This allows a user with namespace edit rights to exploit the operator to claim arbitrary hostnames, leading to subdomain takeover and potential OAuth redirect hijacking.

Detection Guidance

Check for unexpected routeHostName values in Hawtio custom resources by running: kubectl get hawtio -A -o yaml | grep routeHostName. Review OpenShift routes for unauthorized hostnames with: oc get routes -A -o yaml | grep host. Look for routes created by the hawtio-operator with custom hostnames not matching your domain.

Impact Analysis

An attacker with namespace edit access could take over subdomains, intercept OAuth tokens, or redirect users to malicious sites. This could lead to data breaches, unauthorized access, or further exploitation of the affected system.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with privacy regulations, and potential legal consequences for organizations.

Mitigation Strategies

Restrict users from creating or modifying Hawtio custom resources via RBAC policies. Configure OpenShift router admission policies to reject unauthorized hostnames. Review existing Hawtio CR instances for unexpected routeHostName values and remove any suspicious entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81303. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart