CVE-2026-81320

MediumCVSS 5.5/10Last modified Sep 17, 2026

Description

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 15, 2026
Last modified: Sep 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-813219.8CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesyste CVE-2026-813222.1Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error t CVE-2026-813266.8QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's clie CVE-2026-81337.3A security vulnerability has been detected in zyx0814 FilePress up to 2.2.0. Affected by this vulnerability is an unknown functionality of t CVE-2026-813306.5The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits c CVE-2026-813346.1darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array i CVE-2026-813357.5Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name vie CVE-2026-813384.6The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content CVE-2026-813394.3The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz att CVE-2026-81347.2Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when savin CVE-2026-813403.8The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updatin CVE-2026-813416.5wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS