Is CVE-2026-77968 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77968 being exploited in the wild.

How severe is CVE-2026-77968?

High severity, with a CVSS score of 8.2, published 8 September 2026.

Which products and versions are affected?

Red Hat Hawtio-Operator Unknown.

Is there a fix for CVE-2026-77968?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-77968 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77968?

Check whether you run Red Hat Hawtio-Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77968: Hawtio-operator privilege escalation via overpermissioned ClusterRole

CVE-2026-77968 · Severity: high · CVSS 8.2 · Published 2026-09-08

Hawtio-operator is a Kubernetes orchestration tool that manages Hawtio instances across clusters. The operator's service account was granted overly broad cluster-wide permissions to read and modify all Secrets (sensitive credentials) across all namespaces. If an attacker compromises the operator pod, they can access every Secret in the cluster, including bootstrap tokens, cloud credentials, and secrets from other operators, leading to potential cluster-wide credential theft and privilege escalation.

Technologies: Red Hat Hawtio-Operator. Vendors: Red Hat.

Quick answers

Is CVE-2026-77968 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77968 being exploited in the wild.
How severe is CVE-2026-77968?: High severity, with a CVSS score of 8.2, published 8 September 2026.
Which products and versions are affected?: Red Hat Hawtio-Operator Unknown.
Is there a fix for CVE-2026-77968?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-77968 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77968?: Check whether you run Red Hat Hawtio-Operator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a privilege escalation vulnerability caused by improper access control (CWE-269). The hawtio-operator's ClusterRole grants excessive permissions (create, get, list, update, watch) on secrets across all namespaces. While the operator uses a controller-runtime label-selector cache for memory optimization, the underlying ServiceAccount token authorizes direct read access to all Secrets in the cluster, and the operator bypasses the cache via direct API calls. Exploitation requires prior compromise of the operator pod (local/adjacent attack vector), but once compromised, the attacker gains read access to the entire cluster's Secret corpus. The vulnerability has a CVSS v3.1 score of 8.2 with network attack vector requiring low privileges and changed scope. Patches are expected from Red Hat; mitigation involves restricting access to the operator namespace and applying network policies.

Affected products

Red Hat hawtio-operator Unknown

Timeline

2026-09-08: disclosed: CVE-2026-77968 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.