VulnSocial

CVE-2026-78234Disclosure

LOWCVSS 9.9 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-295

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-09-08); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-09-08: 2Mentions · 2026-09-09: 2Patch / Workaround · 2026-09-09: 2Technical Details · 2026-09-08: 2Technical Details · 2026-09-09: 209-0809-09
Signal classification3 categories
Disclosure
250.0%
General
125.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-09-082
Disclosure1General1
2026-09-092
Disclosure1Patch1
Full discourse4 posts
  • VulnTracker@vuln_tracker
    General

    CVE-2026-78234 (CVSS 9.9): hawtio-operator lets any user with "edit" access in any namespace mint fake Service-CA certificates. No admin access required. Affected: Red Hat build of Apache Camel - HawtIO 4 Update now. Details: http://vulntracker.io/cves/CVE-2026-78234 #RedHat #OpenShift #CVE #VulnTracker

    Post summary

    CVE-2026-78234 exposes a high‑severity flaw in the hawtio‑operator, enabling users with "edit" rights to generate fake Service‑CA certificates without admin rights; the vulnerability affects the Red Hat build of HawtIO 4 and is listed with CVSS 9.9, with no patch or exploit details provided.

    00050596
    816 followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    A critical Hawtio Operator vulnerability, tracked as CVE-2026-78234, allows in-cluster service impersonation. Discover the impact and mitigation steps. #HawtioOperator #CVE202678234 #Kubernetes #OpenShift #Vulnerability https://securityonline.info/hawtio-operator-vulnerability-cve-2026-78234/ https://t.co/DwY1yv4Xz9

    Post summary

    The tweet announces a critical Hawtio Operator vulnerability (CVE-2026-78234) that allows in-cluster service impersonation and directs readers to mitigation steps.

    01011419
    12.9K followersView on X
  • Ujjaval ꭗ♥𝘰@ParmarUjjaval3
    Disclosure

    If a namespaced CR can mint cluster identity, that operator is a CA. If a namespaced CR can mint cluster identity, that operator is a CA. CVE-2026-78234, hawtio-operator. it reads the OpenShift Service CA private key, then issues a client cert with whatever CN you put on the Hawtio CR. the operator aggregates that permission into edit/admin. so “I can edit one namespace” becomes “I can impersonate any service that trusts Service CA,” Jolokia included. Red Hat scored it Important because you need edit. edit is not a high bar in most clusters. stop giving controllers the Service CA key because the UI wanted pretty certs. CSR API or a private signer. anything else is cluster-admin with extra steps.

    Post summary

    The passage discloses CVE‑2026‑78234 in the hawtio‑operator, describing how reading the Service CA private key allows arbitrary client cert issuance and privilege escalation, and advises removing that key from controllers as a mitigation.

    0001048
    231 followersView on X
  • ThreatAft@ThreatAft
    Disclosure

    🔐 🚨 hawtio-operator Mass Disclosure — 3 CVEs, CVSS 9.9 PEAK CVE-2026-78234 (9.9): Private CA key access → full cluster impersonation → https://threataft.com/articles/hawtio-operator-3-cves-cvss-9-9 #cybersecurity #infosec #OpenShift #Kubernetes #hawtio #CVSS9 #CVE #ThreatIntel

    Post summary

    A mass disclosure of three high‑severity CVEs in hawtio‑operator is announced, highlighting CVE‑2026‑78234 that allows private CA key access and full cluster impersonation, with a link for additional details.

    00000120
    43 followersView on X

Explore more

Back to dashboard