CVE-2026-78234: Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
Other sources
C-1 from Project Glasswing security audit of hawtio-operator. The operator reads the OpenShift Service CA private signing key and mints client certificates with a Subject CN supplied by the unprivileged author of the namespaced Hawtio CR. Any principal holding the edit or admin aggregated role in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject, enabling impersonation of any in-cluster service identity. Source: hawtio-operator-security-audit.json#C-1.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any principal with the aggregated edit or admin role in any namespace can exploit it. Those roles receive Hawtio custom resource permissions through the operator's ClusterRole aggregation.
What does an attacker need to do to exploit it?
The attacker must be able to create or author a namespaced Hawtio custom resource and supply the desired Subject Common Name. The operator then uses the OpenShift Service CA private signing key to issue a client certificate for that arbitrary subject.
What could an attacker do with an issued certificate?
The certificate can impersonate any in-cluster service identity to components that trust the Service CA for client authentication. The affected peers can include Jolokia agents and other Service-CA-trusting components.
Are default namespace edit and admin permissions affected?
Yes. The operator ships a ClusterRole that aggregates Hawtio custom resource permissions into the edit and admin roles, so users holding either role in any namespace are affected.