CVE-2026-77968
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Summary
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.
Affected Software
| Vendor | Product | Version Range | Status |
|---|
Weaknesses
- CWE-269: Improper Privilege Management
Workarounds
Restrict access to the hawtio-operator namespace and limit who can exec into the operator pod. Monitor cluster audit logs for unexpected Secret access patterns from the hawtio-operator ServiceAccount. As a defence-in-depth measure, apply a NetworkPolicy to the operator namespace restricting egress to only the Kubernetes API server and required service endpoints.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://access.redhat.com/security/cve/CVE-2026-77968
- https://bugzilla.redhat.com/show_bug.cgi?id=2524896
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.