{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81303", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-27T10:25:52.080Z", "datePublished": "2026-09-15T05:35:31.968Z", "dateUpdated": "2026-09-15T05:35:31.968Z"}, "containers": {"cna": {"title": "Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbac-4/hawtio-operator-bundle", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbac-4/hawtio-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-81303", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524897", "name": "RHBZ#2524897", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-15T05:09:48.949Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "description": "Unintended Proxy or Intermediary ('Confused Deputy')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "workarounds": [{"lang": "en", "value": "Administrators can mitigate this issue by restricting which users can create or modify Hawtio custom resources using RBAC policies. Additionally, OpenShift admins can configure the router to use route admission policies that reject Routes claiming hostnames outside of allowed domain patterns. Review existing Hawtio CR instances for unexpected routeHostName values."}], "timeline": [{"lang": "en", "time": "2026-05-20T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-15T05:09:48.949Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-15T05:35:31.968Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{}

{}

{}