Description

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-08T12:16:59.700Z",
  "pubdate": "2026-09-08T12:16:59.700Z",
  "executiveSummary": "The hawtio-operator is susceptible to an OAuth client misconfiguration vulnerability that allows for arbitrary redirect URI injection. The flaw exists in the operator's automated provisioning logic for cluster-scoped OAuthClient resources in cluster mode.\nBy manipulating the Hawtio Custom Resource (CR) spec.routeHostName field, a tenant can register a malicious redirect URI within the cluster-wide OAuth configuration. Because the operator sets the OAuthClient to 'auto' grant mode without requiring a client secret, the system automatically approves access requests.\nThis vulnerability allows an attacker to intercept OpenShift access tokens of any cluster user, including highly privileged accounts, simply by inducing them to visit a crafted authorization URL. No user consent is required, as the auto-approval mechanism bypasses traditional authorization prompts. The attack effectively results in full session hijacking or unauthorized impersonation of legitimate cluster users. There are no authentication requirements for a tenant to trigger this misconfiguration, as the vulnerability is inherent to the operator's provisioning process when Hawtio is deployed in cluster mode.",
  "technicalDetails": "The vulnerability originates in the hawtio-operator's management logic for OpenShift OAuthClient resources. When deploying Hawtio in cluster mode, the operator dynamically generates an OAuthClient that is intended to facilitate authentication for Hawtio instances. However, the operator configures this client with 'GrantMethod: auto', which suppresses the standard OAuth authorization prompt for users.\nCrucially, the operator derives the OAuthClient's redirect URIs directly from the Route resource associated with the Hawtio instance. The hostname for this Route is controlled by the user-defined Hawtio CR through the spec.routeHostName field. Since this field is tenant-controllable, an attacker can supply an arbitrary, attacker-controlled domain or an alternative URI as the host.\nThe attack flow proceeds as follows: 1) The attacker creates or modifies a Hawtio CR with a malicious spec.routeHostName value. 2) The operator consumes this input and creates a cluster-scoped OAuthClient object with the attacker-provided URI registered as a valid redirect target. 3) Because the GrantMethod is set to 'auto', the OpenShift OAuth server does not solicit user confirmation when a request is made against this client. 4) The attacker crafts an authorization request URL pointing to the legitimate OpenShift OAuth endpoint, utilizing the client ID of the newly created OAuthClient and specifying the malicious redirect URI.\nWhen a target victim (such as a cluster administrator) clicks the attacker-supplied authorization link, the OAuth server validates the request against the registry entry created by the operator. Finding the malicious redirect URI valid and the grant method set to automatic, the server silently authorizes the request and redirects the victim to the attacker-controlled endpoint. The URL fragment includes the victim's OpenShift access token as part of the standard OAuth 2.0 implicit flow or authorization code flow implementation.\nThe attacker captures the redirected request, thereby gaining the full bearer token of the victim. This results in the complete compromise of the victim's identity within the OpenShift cluster, allowing the attacker to perform actions with the victim's privileges. The vulnerability is persistent as long as the malicious CR exists and the operator maintains the resulting OAuthClient configuration. No interaction or secret management is required by the attacker beyond manipulating the Hawtio CR configuration."
}