CVE-2026-78234
CriticalCVSS 9.9Summary
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
Risk Assessment
A user with limited privileges can impersonate any service in the cluster, potentially leading to unauthorized access to sensitive data or control over components.
Recommendation
Upgrade hawtio-operator to a patched version and restrict access to Hawtio resources and edit/admin roles.
Other vulnerabilities in hawtio-operator
See all- CVE-2026-80219High
In hawtio-operator, when deploying Hawtio in cluster mode, a cluster-scoped OAuthClient is created with automatic grant approval and no client secret. Redirect URIs are derived from the operator-created Route, whose hostname is tenant-controlled. A malicious tenant can register an arbitrary hostname as a valid OAuth redirect target and obtain OpenShift access tokens of any cluster user who visits the crafted authorization URL.
- CVE-2026-77968High
In hawtio-operator, the ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Although the operator uses a label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.
Original NVD description (English source)
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.