H-2 from Project Glasswing security audit of hawtio-operator. The operator holds routes/custom-host:create cluster-wide and writes the tenant-supplied spec.routeHostName verbatim into Route.Spec.Host. A namespace edit user who normally cannot set custom Route hosts can launder the request through the operator, enabling subdomain takeover and OAuth redirect hijack. Source: hawtio-operator-security-audit.json#H-2.