CyberRota Analysis
AI-GeneratedThe vulnerability exists in the hawtio-operator, where its ClusterRole grants excessive permissions to manage secrets across all namespaces. This flaw allows an attacker who compromises the operator pod to gain read access to sensitive information, including bootstrap tokens and cloud credentials. Organizations using this operator should prioritize remediation to mitigate the risk of unauthorized access to critical secrets within their Kubernetes clusters.
Original NVD Description
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.