Hawtio Operator 4.4 update closes a crafted-database code-execution path

Red Hat has issued a replacement rhbac-4/hawtio-operator-bundle image for Red Hat build of Apache Camel’s Hawtio 4.4 distribution. The update backports fixes for two Important-rated SQLite FTS5 flaws that can end in arbitrary code execution or a process crash.

The operative detail is the image boundary. RHBA-2026:59550 updates the Operator bundle rather than only publishing a host RPM. Red Hat tells users to pull the new image from its registry, amend Dockerfiles or scripts that pin the old image, and rebuild dependent images. The advisory publishes replacement digests for x86_64, aarch64, ppc64le and s390x.

Where the update sits

Hawtio is the management console used to inspect Java runtimes, including Camel applications. Red Hat’s Hawtio 4.4 documentation describes the Hawtio Operator as the preferred installation and deployment mechanism on OpenShift 4. In that path, the Operator bundle is cluster installation material; updating an unrelated workstation SQLite package does not replace the image already selected by the Operator deployment.

That makes the practical action straightforward: OpenShift administrators running Hawtio 4.4 should confirm that the installed Operator resolves to the replacement bundle, not merely that the underlying OpenShift nodes are patched. Any internal catalog, disconnected mirror, image pin or derived image that preserves the previous digest needs to be refreshed. Red Hat also explicitly recommends rebuilding images that depend on the updated bundle.

The exposure boundary

The severity is real, but it is narrower than an unauthenticated network attack against every Hawtio console. Red Hat’s entry for CVE-2026-11822 says exploitation requires a crafted SQLite database containing malformed FTS5 page data. A vulnerable application must process that database and execute an FTS5 MATCH query; the resulting out-of-bounds read and heap overflow can cause a crash, memory exhaustion or code execution.

CVE-2026-11824 has the same essential precondition: an attacker supplies a specially crafted database to an application compiled with FTS5 support. Malicious metadata then triggers an integer underflow and heap-based buffer overflow during MATCH processing. Red Hat scores both flaws 7.8 with a local attack vector, no privileges required and user interaction required.

In other words, simply reaching the Hawtio web interface is not the exploit described in these CVE records. The dangerous boundary is crossed when the vulnerable SQLite library is made to open attacker-controlled FTS5 database content and query it. Deployments that do not accept or process untrusted SQLite files have less direct exposure, but Red Hat lists no practical mitigation that meets its deployment and stability criteria.

What operators should do

Update the Hawtio Operator 4.4 bundle through the normal OpenShift catalog path, refresh mirrored catalogs where applicable, and verify the running installation no longer references the previous image. Rebuild derived images, then restart or roll out affected workloads so the patched image is actually running. The update is the supported fix; configuration-only workarounds are not a substitute for replacing the vulnerable bundle.