CVE-2026-81303
Description
A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.
Statement
A flaw was found in the hawtio-operator for Red Hat build of Apache Camel. The operator reconciles the spec.routeHostName field from the Hawtio custom resource into an OpenShift Route without validating that the requesting namespace is authorized to claim the specified hostname. A user with permission to create Hawtio CRs in their namespace can set an arbitrary hostname belonging to another tenant or domain, resulting in a confused-deputy attack. This can lead to subdomain takeover and, when chained with other flaws, potential OAuth token theft via redirect manipulation.
Mitigation
Administrators can mitigate this issue by restricting which users can create or modify Hawtio custom resources using RBAC policies. Additionally, OpenShift admins can configure the router to use route admission policies that reject Routes claiming hostnames outside of allowed domain patterns. Review existing Hawtio CR instances for unexpected routeHostName values.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.3 | N/A | 6.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
Red Hat CVSS v3 Score Explanation
H-2: routes/custom-host confused deputy — audit CVSS, to be confirmed at triage
Understanding the Weakness (CWE)
Non-Repudiation,Access Control
Technical Impact: Gain Privileges or Assume Identity; Hide Activities; Execute Unauthorized Code or Commands
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
