Description

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-15T06:16:58.800Z",
  "pubdate": "2026-09-15T06:16:58.800Z",
  "executiveSummary": "The hawtio-operator is vulnerable to an information exposure flaw wherein sensitive TLS credentials are inadvertently written to standard output logs. This vulnerability occurs when the operator is configured with a custom Route TLS secret and is operating at a debug log level of 1 or higher.\nThe exposure involves the complete serialization of the Kubernetes Route object, which includes the raw TLS private key encoded in PEM format. Because container logs in the openshift-operators namespace are often ingested by centralized logging platforms, this sensitive data becomes accessible to any user or service account with read permissions for pod logs.\nThe risk associated with this vulnerability is high, as an attacker with standard log-reading privileges can harvest private keys to facilitate man-in-the-middle attacks, impersonate services, or decrypt intercepted traffic. Exploitation is trivial, requiring only the presence of an active debug logging configuration and basic access to the logging infrastructure or the cluster's log aggregation system.",
  "technicalDetails": "The root cause of this vulnerability lies in improper input handling and logging configuration within the hawtio-operator control loop. Specifically, when the operator reconciles a custom Route configuration using a TLS secret, the logic responsible for logging internal state fails to sanitize the Route object during serialization.\nWhen the operator's verbosity is set to debug level 1 or higher, the system performs a full object dump of the Route resource to the standard output stream. The Route object in Kubernetes, when associated with a custom TLS configuration, contains the 'tls' field, which stores the PEM-encoded private key and certificate chain required for secure communication. By serializing the entire object into a JSON format for log entry creation, the operator programmatically renders these sensitive secrets as plain text within the logs.\nThe attack flow follows a predictable pattern: 1) An administrator or automated process enables debug logging (level 1+) to troubleshoot a cluster issue. 2) The hawtio-operator reconciles the Route resource, triggering the debug logging routine. 3) The private key is logged to stdout. 4) The platform's logging collector (e.g., Fluentd or Vector) scrapes the stdout stream and persists the logs into a centralized repository, such as an Elasticsearch or Loki instance. 5) Any actor with 'get' or 'list' permissions on pod logs within the 'openshift-operators' namespace—or access to the centralized logging dashboard—retrieves the logged JSON object and extracts the PEM-encoded private key.\nThis vulnerability is particularly critical due to the broad accessibility of pod logs in many OpenShift environments. The exposure does not require elevated cluster-admin privileges, only the ability to view logs within the namespace where the operator resides. Once the private key is obtained, the attacker can effectively compromise the confidentiality and integrity of the TLS-protected traffic associated with the exposed route. Furthermore, since the key is captured in persistent storage, the window of exposure extends beyond the lifetime of the original pod, remaining until the log retention policy expires or the logs are manually purged.\nThe vulnerability is inherent to the operator's current logging implementation and affects all versions of hawtio-operator where the described logging verbosity exists. No specific authentication or network-level exploitation is required beyond the initial access to the logging facility."
}