Vulnerability · Published Sep 15, 2026 · Assigned by redhat

CVE-2026-81303Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname

Medium 6.3

In plain English

A medium-severity security flaw in Red Hat build of Apache Camel - HawtIO 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.5%top 58.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who normally cannot set custom Route hostnames, can use the operator as a confused deputy to claim arbitrary externally-routable hostnames, enabling subdomain takeover and, in combination with the auto-grant OAuthClient, OAuth redirect hijack.

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat build of Apache Camel - HawtIO 4	see references
Red Hat	Red Hat build of Apache Camel - HawtIO 4	see references

Weakness: CWE-441 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-81303 vdb-entry, x_refsource_REDHAT
RHBZ#2524897 issue-tracking, x_refsource_REDHAT