The hawtio-operator in Red Hat's Apache Camel build holds cluster-wide routes/custom-host:create permissions and writes the spec.routeHostName value from Hawtio custom resources directly into OpenShift Route specs without validating that the requesting namespace is authorized to claim the hostname. This allows a user with namespace edit permissions, who normally cannot set custom Route hostnames, to exploit the operator as a confused deputy to claim arbitrary hostnames. This can lead to subdomain takeover and, when chained with the auto-grant OAuthClient flaw, OAuth redirect hijacking. The vulnerability is tracked as CVE-2026-81303 with a CVSS 3.1 score of 6.3 (medium severity).

An attacker with namespace edit permissions can exploit the operator to claim arbitrary externally-routable hostnames, enabling subdomain takeover. This can further lead to OAuth redirect hijacking if combined with other vulnerabilities, potentially resulting in OAuth token theft. The confidentiality impact is high, integrity impact is low, and availability impact is none according to the CVSS metrics.

Administrators should restrict which users can create or modify Hawtio custom resources using RBAC policies. OpenShift administrators can configure router admission policies to reject Routes claiming hostnames outside allowed domain patterns. It is also recommended to review existing Hawtio custom resource instances for unexpected spec.routeHostName values. No official patch or fix is explicitly stated in the advisory; therefore, these mitigations are the primary recommended actions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.