CVE-2026-78234 (CVSS 9.9): Critical Hawtio Operator Vulnerability Exposes Service Impersonation
Do Son 
Red Hat issued a warning regarding a critical Hawtio Operator vulnerability in Kubernetes and OpenShift environments. This severe flaw allows users with basic edit access to obtain unauthorized certificates. Consequently, attackers can impersonate internal cluster services and execute unauthorized commands.
- CVE: CVE-2026-78234
- CVSS: 9.9 (Critical · CVSSv3)
- Product: Red Hat build of Apache Camel - HawtIO 4
- Impact: Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Why This Matters
The Hawtio Operator automatically deploys diagnostic consoles and manages Java applications. Because it handles sensitive cluster communications, a security breach here is catastrophic. If exploited, an attacker gains cross-tenant impersonation capabilities over critical infrastructure. Red Hat published a CVE-2026-78234 security advisory regarding the impact. The advisory states, “Exploitation enables cross-tenant service impersonation and, via Jolokia MBean invocation on Java workloads, remote code execution.” Therefore, securing this component is vital for cluster integrity.
How the Attack Works
The mechanism involves improper certificate minting within the operator logic. First, the operator extracts the OpenShift Service CA private signing key from the targeted namespace. Then, it uses this key to create client certificates using a Subject Common Name provided by the user. Because the operator aggregates permissions, any namespace editor can request a certificate with an arbitrary subject. Red Hat explains that this action acts as “a signing oracle to any namespace editor.” Ultimately, the attacker uses the forged certificate to deceive peers that trust the Service CA.
Affected Versions
This Hawtio Operator vulnerability impacts clusters deploying the operator for Hawtio management. While exact installation counts remain unconfirmed, the flaw threatens any environment trusting the OpenShift Service CA for client authentication. Currently, no active exploitation in the wild or public proof-of-concept has been confirmed by security researchers.
Patch and Mitigation Steps
Red Hat strongly recommends altering how the operator processes certificates. Administrators should configure the software to use the Kubernetes CSR API instead of directly reading the signing key. As an immediate mitigation, defenders must not set the configuration parameter to values outside the operator’s own namespace. Furthermore, security teams should restrict RBAC permissions for modifying custom resources. Finally, administrators must audit existing instances and rotate any suspect TLS certificates.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
