The vulnerability CVE-2026-81320 affects the hawtio-operator in the Red Hat build of Apache Camel - HawtIO 4. When configured with a custom Route TLS secret and running at debug log level 1 or higher, the operator serializes the entire Route object, including the TLS private key in PEM format, to JSON and writes it to standard output. Since operator logs are forwarded to centralized logging systems and accessible to users with pods/log permissions in the openshift-operators namespace, this results in sensitive TLS private key material being exposed. An attacker with access to these logs could extract the private key and use it to impersonate the service or decrypt intercepted traffic. The vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). The CVSS v3.1 score assigned by Red Hat is 5.5 (medium severity) with a local attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact. The vendor advisory recommends avoiding debug log levels that expose sensitive information and rotating any potentially exposed TLS secrets.

The vulnerability allows disclosure of TLS private key material through operator logs when debug logging is enabled at level 1 or higher. This exposure can lead to compromise of confidentiality by enabling attackers with access to logs to impersonate the service or decrypt intercepted TLS traffic. There is no impact on integrity or availability. The attack requires local access to the operator pod logs or centralized logging systems with pods/log access in the openshift-operators namespace.

Set the operator log verbosity to 0 (the default) to prevent TLS private key material from being logged. If debug logging was previously enabled, rotate any TLS secrets that may have been exposed and purge the affected log entries from centralized logging systems. Avoid logging sensitive information or apply masking if debug logging is necessary. Follow the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-81320 for updates and guidance.