CVE-2026-81303: Hawtio Operator Auth Bypass Vulnerability

CVE-2026-81303 Overview

A flaw in hawtio-operator allows a namespace-scoped user to hijack arbitrary externally-routable hostnames on OpenShift clusters. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A user with edit rights in a namespace, who normally cannot set custom Route hostnames, can weaponize the operator as a confused deputy. The consequences include subdomain takeover and, when combined with the auto-grant OAuthClient, OAuth redirect hijack. The weakness is tracked under [CWE-441: Unintended Proxy or Intermediary (Confused Deputy)].

Critical Impact
A low-privileged namespace user can claim arbitrary cluster hostnames, enabling subdomain takeover and OAuth token theft through redirect hijack.

Affected Products

Red Hat hawtio-operator
OpenShift deployments consuming the Hawtio Custom Resource
Environments where the operator's auto-grant OAuthClient is enabled

Discovery Timeline

2026-09-15 - CVE-2026-81303 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-81303

Vulnerability Analysis

The hawtio-operator reconciles Hawtio custom resources and provisions supporting objects, including OpenShift Route objects that expose the console externally. To create routes with arbitrary hostnames, the operator holds the cluster-scoped routes/custom-host:create permission. This permission normally gates who may assign non-default hostnames to a Route, since custom hostnames influence external routing and TLS termination.

The operator reads the spec.routeHostName field supplied by the tenant in the Hawtio custom resource and copies it verbatim into Route.spec.host. No validation confirms that the requesting namespace user is entitled to that hostname, and no allow-list constrains which DNS names may be claimed. A namespace edit user can therefore submit any hostname and have the operator write it on their behalf.

This is a textbook confused deputy pattern. The operator has authority the caller lacks and performs the privileged action without authorization checks on the caller's intent. When combined with the auto-grant OAuthClient that Hawtio installs, an attacker can register a Route hostname that matches or shadows a legitimate redirect target and intercept OAuth authorization codes.

Root Cause

The root cause is missing authorization mediation between the tenant-supplied spec.routeHostName value and the privileged routes/custom-host:create capability the operator wields. The operator trusts input from any principal permitted to create or edit the Hawtio custom resource in a namespace.

Attack Vector

An attacker requires namespace edit rights and network access to the OpenShift API. The attacker creates or modifies a Hawtio custom resource with spec.routeHostName set to a target hostname on the cluster's ingress domain. The operator reconciles the resource and creates a Route claiming the chosen hostname. Traffic sent to the hijacked hostname reaches the attacker's namespace workload, enabling subdomain takeover, phishing, and OAuth redirect interception against the Hawtio OAuthClient.

No verified exploit code has been published for this issue. See the Red Hat CVE-2026-81303 Advisory and Red Hat Bug Report #2524897 for vendor detail.

Detection Methods for CVE-2026-81303

Indicators of Compromise

Hawtio custom resources containing a spec.routeHostName value that does not match the tenant's assigned subdomain pattern.
OpenShift Route objects owned by the hawtio-operator service account with spec.host values outside the expected namespace ingress scheme.
OAuth authorization requests redirecting to Hawtio-provisioned Routes on unexpected hostnames.

Detection Strategies

Audit Kubernetes API server logs for create and update events on hawtio.hawt.io custom resources where spec.routeHostName is populated.
Compare each Route's spec.host against an allow-list of hostnames legitimately owned by the requesting namespace.
Alert when the hawtio-operator service account writes Routes whose hostnames overlap with cluster-critical services or OAuth redirect URIs.

Monitoring Recommendations

Continuously monitor OAuthClientredirectURIs for drift and unexpected additions tied to Hawtio deployments.
Track DNS resolution and TLS certificate issuance events for cluster ingress domains to identify unauthorized hostname claims.
Enable OpenShift audit policy at Metadata level or higher for Route and OAuthClient resources to preserve forensic evidence.

How to Mitigate CVE-2026-81303

Immediate Actions Required

Upgrade hawtio-operator to the fixed release identified in the Red Hat CVE-2026-81303 Advisory as soon as it is available for your channel.
Inventory existing Hawtio custom resources cluster-wide and remove or correct any spec.routeHostName values that were not set by cluster administrators.
Rotate secrets and OAuth client credentials associated with Hawtio if unauthorized Route hostnames are found.

Patch Information

Red Hat tracks remediation under advisory CVE-2026-81303 and bug #2524897. Apply the vendor-supplied operator update, which is expected to validate spec.routeHostName against caller authorization before propagating the value into the Route spec.

Workarounds

Restrict create and update permissions on Hawtio custom resources to trusted cluster administrators until the patched operator is deployed.
Deploy an admission webhook or Kyverno/OPA Gatekeeper policy that rejects Hawtio resources whose spec.routeHostName falls outside the namespace's approved hostname pattern.
Disable the auto-grant OAuthClient behavior where feasible to reduce the impact of any hostname claim to subdomain takeover alone.

bash

# Example Kyverno policy fragment restricting spec.routeHostName
# Reject Hawtio CRs where routeHostName is set by non-admin users
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-hawtio-routehostname
spec:
  validationFailureAction: Enforce
  rules:
    - name: block-custom-hostname
      match:
        any:
          - resources:
              kinds:
                - hawtio.hawt.io/v1/Hawtio
      exclude:
        any:
          - clusterRoles:
              - cluster-admin
      validate:
        message: "spec.routeHostName may only be set by cluster administrators"
        pattern:
          spec:
            X(routeHostName): ""