https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 07:20:51 +0000 https://cve.radiocsirt.org/vuln/fkie_cve-2026-80219 <p>Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.</p> <p>Rejected reason: Red Hat Product Security has come to the conclusion that this CVE is not needed.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-80219 https://cve.radiocsirt.org/vuln/ghsa-7xpg-hm9r-chmf <p>A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.</p> <p>A flaw was found in hawtio-operator. When deploying Hawtio in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) and no client secret (public client). The redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled via the Hawtio CR spec.routeHostName field. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and, because grants are auto-approved, obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL without any consent prompt.</p> https://cve.radiocsirt.org/vuln/ghsa-7xpg-hm9r-chmf