RED Hat has flagged a critical vulnerability in Hawtio Operator used with Kubernetes and OpenShift. Identified as CVE-2026-78234 and rated CVSS 9.9, the flaw affects Hawtio-operator installations that rely on the OpenShift Service CA for client authentication. The advisory warns that exploitation could enable cross-tenant service impersonation and, via Jolokia MBean invocation on Java workloads, remote code execution. At the time of reporting, there were no confirmed instances of active exploitation.
How the attack works, as described by Red Hat, centres on improper certificate minting within the operator. An editor with namespace‑level access can request a certificate bearing an arbitrary Common Name (CN), because the operator aggregates permissions and effectively functions as a signing oracle. The operator extracts the OpenShift Service CA private signing key from the targeted namespace and uses it to issue client certificates with the user‑supplied subject.
The forged certificate can then be used to impersonate trusted services within the cluster. The advisory stresses the severity given the potential to deceive peers that trust the Service CA and to facilitate cross‑tenant access and control.
Mitigation guidance is explicit. Organisations should modify how the operator handles certificates, configuring it to use the Kubernetes CSR API rather than reading the signing key directly. In the meantime, keep configuration within the operator’s own namespace, tighten RBAC to limit modifications of custom resources, and audit and rotate TLS certificates across affected instances. There is no confirmed exploitation yet, but the risk warrants urgent review of Hawtio‑operator deployments.