Executive brief
The hawtio-operator for Apache Camel logs TLS private keys to standard output when debug logging is enabled. These logs are typically forwarded to centralized systems accessible to anyone with pod log access, potentially exposing encryption keys that attackers could use to impersonate services or decrypt traffic.
Technical details
The hawtio-operator improperly serializes the entire Route object—including TLS private keys in PEM format—to JSON and writes it to stdout when log verbosity is set to debug level 1 or higher. This is a sensitive information logging vulnerability (CWE-532) where credential material is exposed in operator logs. The attack vector is local, requiring low privileges and access to pod logs or centralized log aggregation systems. An attacker with such access can extract the TLS private key and use it to impersonate the service or decrypt intercepted traffic. Mitigation includes setting log verbosity to 0 (default), rotating any exposed TLS secrets, and purging affected log entries.
Affected products
- Red Hat hawtio-operator <UNKNOWN>
Timeline
- 2026-09-15: disclosed