Executive brief
Hawtio-operator is a Kubernetes orchestration tool that manages Hawtio instances across clusters. The operator's service account was granted overly broad cluster-wide permissions to read and modify all Secrets (sensitive credentials) across all namespaces. If an attacker compromises the operator pod, they can access every Secret in the cluster, including bootstrap tokens, cloud credentials, and secrets from other operators, leading to potential cluster-wide credential theft and privilege escalation.
Technical details
This is a privilege escalation vulnerability caused by improper access control (CWE-269). The hawtio-operator's ClusterRole grants excessive permissions (create, get, list, update, watch) on secrets across all namespaces. While the operator uses a controller-runtime label-selector cache for memory optimization, the underlying ServiceAccount token authorizes direct read access to all Secrets in the cluster, and the operator bypasses the cache via direct API calls. Exploitation requires prior compromise of the operator pod (local/adjacent attack vector), but once compromised, the attacker gains read access to the entire cluster's Secret corpus. The vulnerability has a CVSS v3.1 score of 8.2 with network attack vector requiring low privileges and changed scope. Patches are expected from Red Hat; mitigation involves restricting access to the operator namespace and applying network policies.
Affected products
- Red Hat hawtio-operator Unknown
Timeline
- 2026-09-08: disclosed: CVE-2026-77968 published