CVE-2026-80219 Red Hat CVE debrief

Who should care

Defenders responsible for OpenShift cluster security, particularly those managing OAuthClients and access tokens, should assess exposure and prioritize verification. This includes reviewing OAuthClient configurations, assessing the impact of the flaw on OpenShift access tokens, and verifying exposure of cluster-scoped OAuthClients with automatic grant approval and no client secret.

Why it matters

The flaw in hawtio-operator allows a malicious tenant to obtain OpenShift access tokens of any cluster user who visits a crafted authorization URL without consent, potentially leading to unauthorized access and elevation of privileges.

• Potential unauthorized access to OpenShift cluster resources
• Possible elevation of privileges for malicious tenants
• Need for verification of OAuthClient configurations and access token management
• Potential for phishing attacks using crafted authorization URLs

Technical summary

The flaw in hawtio-operator allows a malicious tenant to register an arbitrary hostname as a valid OAuth redirect target and obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without consent. This issue arises when deploying Hawtio in cluster mode, where the operator creates a cluster-scoped OAuthClient with automatic grant approval and no client secret. The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field.

Defensive priority

Defenders should prioritize verifying exposure of cluster-scoped OAuthClients with automatic grant approval and no client secret.

Recommended defensive actions

• Verify exposure of cluster-scoped OAuthClients with automatic grant approval and no client secret
• Assess the impact of the flaw on OpenShift access tokens
• Review and update OAuthClient configurations to prevent similar issues
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the flaw in hawtio-operator, including its CVSS score and severity. The flaw allows a malicious tenant to register an arbitrary hostname as a valid OAuth redirect target and obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without consent. Defenders should verify exposure of cluster-scoped OAuthClients with automatic grant approval and no client secret.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.