CVE-2026-78234
Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
| CWE | CWE-295 |
| Vendor | red hat |
| Product | red hat build of apache camel - hawtio 4 |
| Published | Sep 8, 2026 |
| Last Updated | Sep 8, 2026 |
Get instant alerts for red hat red hat build of apache camel - hawtio 4
Be the first to know when new critical vulnerabilities affecting red hat red hat build of apache camel - hawtio 4 are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H