CVE WatchSep 8, 2026

CVE-2026-77968

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Wh

CVSS

8.2

High

EPSS

—

KEV

—

Exploit Today

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-269

EPSS · 30d

Not enough EPSS history yet.

Technical description

A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-848699.9 CRI

—

———A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.10h CVE-2026-588747.8 HIG

—

———In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.9h CVE-2026-588467.8 HIG

—

———In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.9h CVE-2026-688305.5 MED

—

———Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.9h CVE-2026-668188.8 HIG

—

———Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network.12h CVE-2026-865164.7 MED

—

——0A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file deployment/aws/shared/github-oidc-role.yaml of the component AWS GitHub OIDC Deployment Helper Script. Performing a manipulation results in improper privilege management. It is possible to initiate the attack remotely. The patch is named 6ab3147282d867c1993f995272750db091c2290b. Applying a patch is the recommended action to fix this issue.17h