CVE-2026-81303

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-81303", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-27T10:25:52.080Z", "datePublished": "2026-09-15T05:35:31.968Z", "dateUpdated": "2026-09-15T17:52:24.958Z"}, "containers": {"cna": {"title": "Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbac-4/hawtio-operator-bundle", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbac-4/hawtio-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-81303", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524897", "name": "RHBZ#2524897", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-15T05:09:48.949Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-441", "description": "Unintended Proxy or Intermediary ('Confused Deputy')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')", "workarounds": [{"lang": "en", "value": "Administrators can mitigate this issue by restricting which users can create or modify Hawtio custom resources using RBAC policies. Additionally, OpenShift admins can configure the router to use route admission policies that reject Routes claiming hostnames outside of allowed domain patterns. Review existing Hawtio CR instances for unexpected routeHostName values."}], "timeline": [{"lang": "en", "time": "2026-05-20T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-15T05:09:48.949Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-15T05:35:31.968Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-15T17:50:38.786528Z", "id": "CVE-2026-81303", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T17:52:24.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-81303", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-15T17:50:38.786528Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T17:52:15.799Z"}}], "cna": {"title": "Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "packageName": "rhbac-4/hawtio-operator-bundle", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "packageName": "rhbac-4/hawtio-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-20T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-15T05:09:48.949Z", "value": "Made public."}], "datePublic": "2026-09-15T05:09:48.949Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-81303", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524897", "name": "RHBZ#2524897", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Administrators can mitigate this issue by restricting which users can create or modify Hawtio custom resources using RBAC policies. Additionally, OpenShift admins can configure the router to use route admission policies that reject Routes claiming hostnames outside of allowed domain patterns. Review existing Hawtio CR instances for unexpected routeHostName values."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-441", "description": "Unintended Proxy or Intermediary ('Confused Deputy')"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-15T05:35:31.968Z"}, "x_redhatCweChain": "CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')"}}, "cveMetadata": {"cveId": "CVE-2026-81303", "state": "PUBLISHED", "dateUpdated": "2026-09-15T17:52:24.958Z", "dateReserved": "2026-08-27T10:25:52.080Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-15T05:35:31.968Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "affected", "packageName": "rhbac-4/hawtio-operator-bundle", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "affected", "packageName": "rhbac-4/hawtio-rhel9", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack."}], "id": "CVE-2026-81303", "lastModified": "2026-09-16T19:42:43.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81303", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-15T17:50:38.786528Z", "version": "2.0.3"}}]}, "published": "2026-09-15T06:16:58.167", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-81303"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524897"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-441"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routeHostName", "id": "2524897", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524897"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N", "status": "draft"}, "cwe": "CWE-441", "details": ["A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack."], "mitigation": {"lang": "en:us", "value": "Administrators can mitigate this issue by restricting which users can create or modify Hawtio custom resources using RBAC policies. Additionally, OpenShift admins can configure the router to use route admission policies that reject Routes claiming hostnames outside of allowed domain patterns. Review existing Hawtio CR instances for unexpected routeHostName values."}, "name": "CVE-2026-81303", "package_state": [{"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "rhbac-4/hawtio-operator-bundle", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Fix deferred", "impact": "moderate", "package_name": "rhbac-4/hawtio-rhel9", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}], "public_date": "2026-09-15T05:09:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-81303\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-81303"], "statement": "A flaw was found in the hawtio-operator for Red Hat build of Apache Camel. The operator reconciles the spec.routeHostName field from the Hawtio custom resource into an OpenShift Route without validating that the requesting namespace is authorized to claim the specified hostname. A user with permission to create Hawtio CRs in their namespace can set an arbitrary hostname belonging to another tenant or domain, resulting in a confused-deputy attack. This can lead to subdomain takeover and, when chained with other flaws, potential OAuth token theft via redirect manipulation.", "threat_severity": "Moderate"}

{"created": "2026-09-16T06:30:11.438648+00:00", "updated": "2026-09-17T21:00:17.446012+00:00", "vendors": []}