Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Hawtio lets edit users create trusted certificates

CVE-2026-78234 · published 1 month ago
Summary

In Red Hat Build of Apache Camel - Hawtio, any user who can edit resources in a project can ask the system to create a trusted security credential using the cluster's own signing key. That credential can be used to pretend to be any internal service that trusts the cluster, giving the user unauthorized access. Limit edit permissions, apply the latest update, or reconfigure the operator to stop it from using the signing key.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
red hat red hat build of apache camel - hawtio 4 All versions
Original advisory text
Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-295Improper Certificate Validation
Timeline
Published8 Sep 2026
Updated11 Oct 2026
First seen8 Sep 2026
Sources
CVE-2026-78234 · NVD
CVE-2026-78234 · MITRE
Track software like this
Free during beta