Debug Log Exposure in Hawtio Operator Reveals TLS Private Key

Executive Summary

This vulnerability affects the hawtio-operator. When debug logging is enabled (level 1 or higher) and a custom Route TLS secret is configured, the operator logs the entire Route object, including the TLS private key in PEM format, to stdout. These logs are often forwarded to centralized systems and may be accessible to users with pods/log permissions in OpenShift.

Useful 0 Not Useful 0

Detection Guidance

Check operator logs for debug level settings and Route TLS secret configurations. Look for serialized Route objects containing TLS private keys in logs. Use commands like 'oc logs <hawtio-operator-pod> --tail=100' in OpenShift to inspect logs for exposed keys.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to these logs could extract the private key and use it to impersonate the service or decrypt intercepted traffic. This could lead to unauthorized access, data breaches, or man-in-the-middle attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to exposure of sensitive data (TLS private keys), potentially violating compliance requirements such as GDPR (data protection) or HIPAA (health information privacy). Unauthorized access to private keys may result in regulatory penalties due to data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Set operator log verbosity to 0 (default) to prevent TLS key logging. Rotate any exposed TLS secrets and purge affected log entries from centralized logging systems. Exclude sensitive data from logs or apply masking.

Useful 0 Not Useful 0