{"api_version":"1","generated_at":"2026-09-15T07:48:30+00:00","cve":"CVE-2026-81320","urls":{"html":"https://cve.report/CVE-2026-81320","api":"https://cve.report/api/cve/CVE-2026-81320.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-81320","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-81320"},"summary":{"title":"Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level","description":"A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.","state":"PUBLISHED","assigner":"redhat","published_at":"2026-09-15 06:16:58","updated_at":"2026-09-15 06:16:58"},"problem_types":["CWE-532","CWE-532 Insertion of Sensitive Information into Log File"],"metrics":[{"version":"3.1","source":"secalert@redhat.com","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-81320","name":"https://access.redhat.com/security/cve/CVE-2026-81320","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524898","name":"https://bugzilla.redhat.com/show_bug.cgi?id=2524898","refsource":"secalert@redhat.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-81320","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81320","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Red Hat","product":"Red Hat build of Apache Camel - HawtIO 4","version":"","platforms":[]}],"timeline":[{"source":"CNA","time":"2026-05-20T00:00:00.000Z","lang":"en","value":"Reported to Red Hat."},{"source":"CNA","time":"2026-09-15T05:11:15.414Z","lang":"en","value":"Made public."}],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Exclude logging sensitive info or apply masking.\nSet the operator log verbosity to 0 (the default) to prevent TLS key material from being written to logs. If debug logging has been enabled previously, rotate any TLS secrets that may have been exposed in the logs and purge the affected log entries from centralized logging systems.","time":"","lang":"en"}],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:apache_camel_hawtio:4"],"defaultStatus":"affected","packageName":"rhbac-4/hawtio-rhel9","product":"Red Hat build of Apache Camel - HawtIO 4","vendor":"Red Hat"}],"datePublic":"2026-09-15T05:11:15.414Z","descriptions":[{"lang":"en","value":"A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting."}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Moderate"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-532","description":"Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-15T05:35:37.603Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-81320"},{"name":"RHBZ#2524898","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524898"}],"timeline":[{"lang":"en","time":"2026-05-20T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-15T05:11:15.414Z","value":"Made public."}],"title":"Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level","workarounds":[{"lang":"en","value":"Exclude logging sensitive info or apply masking.\nSet the operator log verbosity to 0 (the default) to prevent TLS key material from being written to logs. If debug logging has been enabled previously, rotate any TLS secrets that may have been exposed in the logs and purge the affected log entries from centralized logging systems."}],"x_generator":{"engine":"cvelib 1.8.0"},"x_redhatCweChain":"CWE-532: Insertion of Sensitive Information into Log File"}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2026-81320","datePublished":"2026-09-15T05:35:37.603Z","dateReserved":"2026-08-27T10:25:52.083Z","dateUpdated":"2026-09-15T05:35:37.603Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-15 06:16:58","lastModifiedDate":"2026-09-15 06:16:58","problem_types":["CWE-532","CWE-532 Insertion of Sensitive Information into Log File"],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"81320","Ordinal":"1","Title":"Hawtio-operator: hawtio-operator: tls private key written to ope","CVE":"CVE-2026-81320","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"81320","Ordinal":"1","NoteData":"A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are typically forwarded to centralized logging systems and readable by anyone with pods/log access in the openshift-operators namespace. Debug level 1 is a low threshold commonly enabled during troubleshooting.","Type":"Description","Title":"Hawtio-operator: hawtio-operator: tls private key written to ope"}]}}}