CVE-2026-78234

A flaw in hawtio-operator lets the operator mint client certificates signed with the OpenShift Service CA private signing key using an arbitrary Subject Common Name taken from a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace — not just cluster administrators — can trigger issuance of a Service-CA-signed certificate with a subject of their choosing. An attacker can use such a certificate to impersonate any in-cluster service identity toward peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components, producing high confidentiality, integrity and availability impact across the cluster (CVSS 9.9, scope changed). Only OpenShift clusters running hawtio-operator where non-administrators hold edit-level rights in some namespace are affected. No public proof-of-concept, KEV listing, or known exploitation exists; EPSS estimates the 30-day exploitation probability at 0.2%.

What to do: Upgrade hawtio-operator to the latest patched release once available (no fixed version is specified in the available data); until then, consider removing or restricting the aggregated Hawtio custom-resource permissions from the edit and admin ClusterRoles so only cluster administrators can create or modify Hawtio CRs. Audit recently issued Service-CA client certificates for unexpected subject CNs, and review which in-cluster components (e.g., Jolokia agents) trust the Service CA for client authentication.