CVE-2026-81303

Summary

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.

Affected Software

VendorProductVersion RangeStatus

Weaknesses

  • CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')

Workarounds

Administrators can mitigate this issue by restricting which users can create or modify Hawtio custom resources using RBAC policies. Additionally, OpenShift admins can configure the router to use route admission policies that reject Routes claiming hostnames outside of allowed domain patterns. Review existing Hawtio CR instances for unexpected routeHostName values.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References