External risk intelligence

Hawtio Operator Allows Certificate Impersonation Using Service CA Key.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-78234

This vulnerability affects an operator managing internal cluster resources and authentication components. It requires existing access to create or edit custom resources within the Kubernetes/OpenShift cluster, which is a highly privileged, internal administrative task, not a public-facing network service or internet-accessible interface.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in hawtio-operator, a component used in OpenShift environments. The flaw allows a user with edit access in any namespace to obtain a forged certificate that can impersonate trusted in-cluster services. This could potentially allow unauthorized access to sensitive components that rely on these service identities for authentication.

Allows forging trusted service identities.
Confirms privilege escalation within the cluster.
Assess exposure to internal impersonation risks.

Attack Path

How an attacker could exploit the issue

An attacker with edit access in any OpenShift namespace can exploit this flaw. They can craft a namespaced Hawtio custom resource, which the hawtio-operator then processes. This processing allows the operator to mint a Service-CA-signed client certificate using an arbitrary subject name. The attacker can then use this forged certificate to impersonate trusted in-cluster service identities, potentially leading to significant compromise of internal cluster services.

Entry condition: Edit access in any namespace.
Trigger point: Creating a Hawtio custom resource.
Resulting risk: Impersonate in-cluster services.

Live Threat

Current exploitation, exposure, and threat context

The hawtio-operator flaw could allow an attacker with edit access in any namespace to mint client certificates. These certificates could then be used to impersonate any in-cluster service identity to components that trust the Service CA for client authentication.

In-cluster service identities could be impersonated.
Arbitrary client certificates can be generated.
Unauthorized access to trusted services may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in hawtio-operator allows authenticated users with edit access in any namespace to mint Service-CA-signed certificates, enabling impersonation of in-cluster services. The immediate first step is to identify all instances of the affected hawtio-operator, confirm their reachability and business criticality within your OpenShift environment, and then identify the accountable platform or security team to plan remediation.

Platform or security team ownership is likely.
Verify affected hawtio-operator deployments.
Plan remediation based on exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the hawtio-operator?

The hawtio-operator is a software component designed for OpenShift environments. It manages Hawtio instances, which provide a web-based management console for Java applications. By automating the deployment and configuration of these consoles, it helps administrators monitor and manage Java-based services running within the cluster.

What does CWE-295 mean for CVE-2026-78234?

CWE-295 refers to Improper Certificate Validation. In the context of this CVE, the operator incorrectly allows the creation of certificates with arbitrary identities. Because it uses the cluster's own Service CA to sign these requests, the resulting certificates are deceptively trusted by other internal services, bypassing standard security authentication checks.

How is this vulnerability triggered?

An attacker triggers this by creating or editing a Hawtio custom resource within a namespace where they already have edit permissions. Simply having the operator installed does not trigger the bug; it requires an authenticated user to actively submit a crafted resource definition that the operator then processes to issue the forged certificate.

Is my cluster at risk if it is not internet-facing?

Yes. Halo Surface Signal identifies this as an internal risk because it targets cluster-level authentication components. Even if your cluster has no public-facing services, an attacker who gains low-level edit access to any namespace can impersonate trusted services, move laterally, and access other sensitive internal components.

What steps should I take if I use hawtio-operator?

First, locate all running instances of the hawtio-operator within your OpenShift environment. Once identified, document which teams manage these specific deployments and coordinate with them to prioritize updates. Do not attempt manual certificate revocation without consulting your platform team, as this could disrupt existing legitimate service communication.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.