The vulnerability in hawtio-operator occurs because it creates an OAuthClient with GrantMethod set to 'auto' and no client secret, making it a public client with automatic grant approval. The redirect URIs are derived from a Route whose hostname is controlled by the tenant via the Hawtio CR spec.routeHostName field. A malicious tenant with edit access in any namespace can register an arbitrary hostname as a redirect target and craft an authorization URL that steals OAuth tokens from any cluster user who visits it, bypassing user consent. This leads to unauthorized access tokens being issued, compromising confidentiality and integrity of user sessions in OpenShift clusters.

An attacker with edit access in any namespace can steal OAuth tokens of any cluster user without their consent by exploiting the automatic grant approval and tenant-controlled redirect URIs. This allows the attacker to impersonate users and gain unauthorized access to cluster resources, resulting in high confidentiality and integrity impact. Availability is not affected.

Red Hat recommends administrators manually patch the OAuthClient resource created by the hawtio-operator to set grantMethod to 'prompt' instead of 'auto' and add a client secret. This forces explicit user consent for each OAuth authorization request and prevents unauthorized token acquisition. Additionally, administrators should monitor OpenShift OAuth server audit logs for unexpected authorization grants to the hawtio OAuthClient. No official fix or patch version is currently confirmed; check the Red Hat advisory for updates.