CVE-2026-80219 Red Hat CVE debrief

Who should care

OpenShift cluster administrators and users who deploy Hawtio in cluster mode should assess their exposure and verify the security of their user access tokens. Cluster users may be affected by unauthorized access to their accounts, and defenders must verify exposure of OpenShift clusters using Hawtio in cluster mode. Remediation priority is high due to potential for unauthorized access.

Why it matters

A flaw in hawtio-operator allows malicious tenants to obtain OpenShift access tokens of any cluster user who visits a crafted authorization URL without consent, impacting cluster users and requiring prompt verification and remediation.

• Malicious tenants can obtain OpenShift access tokens without user consent
• Cluster users may be affected by unauthorized access to their accounts
• Defenders must verify exposure of OpenShift clusters using Hawtio in cluster mode
• Remediation priority is high due to potential for unauthorized access

Technical summary

The hawtio-operator creates a cluster-scoped OAuthClient with automatic grant approval and no client secret, allowing a malicious tenant to register an arbitrary hostname as a valid OAuth redirect target and obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without consent. This vulnerability impacts OpenShift cluster users and requires prompt verification and remediation to prevent unauthorized access. Defenders should prioritize verifying exposure of OpenShift clusters using Hawtio in cluster mode and assess user access token security.

Defensive priority

Defenders should prioritize verifying exposure of OpenShift clusters using Hawtio in cluster mode and assess user access token security.

Recommended defensive actions

• Verify OpenShift cluster exposure to Hawtio in cluster mode
• Assess user access token security and validate redirect URIs
• Implement compensating controls to monitor and limit access token usage
• Review vendor patch guidance for Hawtio-operator updates
• Conduct exposure review for affected OpenShift clusters
• Enhance monitoring for suspicious access token activities
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the flaw in hawtio-operator, including its impact on OpenShift access tokens. The vulnerability allows malicious tenants to register arbitrary hostnames as valid OAuth redirect targets, leading to unauthorized access. Defenders should verify exposure of OpenShift clusters using Hawtio in cluster mode and assess user access token security.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.