CyberRota Analysis
AI-GeneratedA vulnerability exists in the Hawtio operator that allows a malicious tenant to exploit the automatic grant approval mechanism for OAuthClient, which is created without a client secret. This flaw enables attackers to register arbitrary hostnames as valid OAuth redirect targets, potentially obtaining OpenShift access tokens for any user who interacts with the malicious authorization URL, bypassing consent prompts. Organizations using Hawtio in cluster mode should prioritize addressing this issue to prevent unauthorized access to user tokens and protect their cluster environments.
Original NVD Description
A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.