CVE-2026-80219

✕ Withdrawn — historical dataHIGHPre-NVD 8.7
8.7CVSS

A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.

CVSS v3
8.7
EchelonGraph score
Not yet assessedThis CVE record was withdrawn by its numbering authority, so there is no vulnerability to rate.
EPSS PROB
—
EPSS %ILE
—
KEV
—Not applicable: this CVE ID was withdrawn

Published

September 8, 2026

Last Modified

September 17, 2026

References (2)

Frequently asked(4)

What is CVE-2026-80219?
CVE-2026-80219 is a rejected CVE ID: its record was withdrawn on September 21, 2026 and no longer describes a vulnerability. Reason given: Red Hat Product Security has come to the conclusion that this CVE is not needed.
When was the CVE record for CVE-2026-80219 published?
The CVE record for CVE-2026-80219 was published on September 8, 2026. EchelonGraph's copy of the record carries a last-modified date of September 17, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-80219?
CVE-2026-80219 has a CVSS base score of 8.7 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-80219?
There is nothing to remediate under CVE-2026-80219: it is a rejected (withdrawn) CVE ID and no longer describes a vulnerability.