CVE-2026-78234

Published Sep 8, 2026

Last updated 2 days ago

CVSS critical 9.9
Container Security

Overview

Description
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
Source
secalert@redhat.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9.9
Impact score
6
Exploitability score
3.1
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

secalert@redhat.com
CWE-295

Social media

Hype score
Not currently trending

  1. CVE-2026-78234 (CVSS 9.9): hawtio-operator lets any user with "edit" access in any namespace mint fake Service-CA certificates. No admin access required. Affected: Red Hat build of Apache Camel - HawtIO 4 Update now. Details: https://t.co/2tljoSVmI6 #RedHat #OpenShift #CVE ht

    @vuln_tracker

    8 Sept 2026

    496 Impressions

    0 Retweets

    5 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 🔐 🚨 hawtio-operator Mass Disclosure — 3 CVEs, CVSS 9.9 PEAK CVE-2026-78234 (9.9): Private CA key access → full cluster impersonation → https://t.co/uUS4RM9xp4 #cybersecurity #infosec #OpenShift #Kubernetes #hawtio #CVSS9 #CVE #ThreatIntel

    @ThreatAft

    8 Sept 2026

    116 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. CVE-2025-14269
  2. A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted.•CVE-2026-17113
  3. JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability•CVE-2026-66384
  4. A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.•CVE-2026-15809
  5. BerriAI LiteLLM Improper Authentication Vulnerability•CVE-2026-59822

References

Sources include official advisories and independent security research.