Hawtio Operator OAuth Redirect URI Validation Bypass

CVE-2026-80219 exploits a critical misconfiguration in hawtio-operator's cluster-mode deployment where OAuth clients are created with automatic grant approval and no client secret validation. The vulnerability allows malicious tenants to manipulate the Hawtio CR spec.routeHostName field to register arbitrary hostnames as valid OAuth redirect targets. Since the operator auto-approves OAuth grants without proper validation, an attacker can redirect legitimate authentication flows to attacker-controlled endpoints and capture OpenShift API tokens. This affects any organization deploying hawtio-operator in multi-tenant Kubernetes clusters where tenant-controlled specifications can influence security-critical OAuth configurations.

While this CVE doesn't map to specific MITRE ATT&CK techniques in the current threat framework, Casky's security skills would detect the underlying attack patterns through analysis of OAuth configuration anomalies and credential access attempts. Practitioners using Casky would identify suspicious patterns including: unauthorized Route hostname modifications, OAuth client configuration drift from baseline policies, unexpected redirect URI registrations pointing to external domains, and token exfiltration attempts following authentication flows. Claude's extended reasoning capabilities would correlate these indicators to surface the attack chain—from initial tenant access through configuration manipulation to final token capture—enabling security teams to detect compromised deployments before tokens are exploited for persistent cluster access.