https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 13:14:13 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-77968 <p>A flaw was found in hawtio-operator. The operator&#39;s ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators&#39; secrets.</p> <p>A flaw was found in hawtio-operator. The operator&#39;s ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators&#39; secrets.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-77968 https://vulnerability.circl.lu/vuln/ghsa-r6x8-cqxr-wwp4 <p>A flaw was found in hawtio-operator. The operator&#39;s ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators&#39; secrets.</p> <p>A flaw was found in hawtio-operator. The operator&#39;s ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators&#39; secrets.</p> https://vulnerability.circl.lu/vuln/ghsa-r6x8-cqxr-wwp4 https://vulnerability.circl.lu/vuln/rhsa-2026:66120 <p>hawtio-operator: hawtio-operator: Cluster-wide secrets read/write granted to operator ServiceAccount hawtio-operator: hawtio-operator: Service-CA signing oracle allows arbitrary-CN certificate issuance to namespace edit users</p> <p>hawtio-operator: hawtio-operator: Cluster-wide secrets read/write granted to operator ServiceAccount hawtio-operator: hawtio-operator: Service-CA signing oracle allows arbitrary-CN certificate issuance to namespace edit users</p> https://vulnerability.circl.lu/vuln/rhsa-2026:66120