EUVD-2026-72693
GHSA-hvx2-xh3r-xcr6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Low-privileged namespace editor can, over the cluster API with no interaction, mint a cross-trust-domain identity certificate; scope changes and impersonation yields full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
3DescriptionCVE.org
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
AnalysisAI
Privilege escalation and cross-service impersonation in Red Hat's hawtio-operator (shipped with Red Hat Build of Apache Camel - Hawtio 4) lets any authenticated user holding namespace 'edit' rights obtain an OpenShift Service-CA-signed client certificate with an attacker-chosen Subject CN. Because the operator reads the Service CA private signing key and mints certificates using a CN supplied in a namespaced Hawtio custom resource - and its ClusterRole aggregates Hawtio CR permissions into the standard edit/admin roles - a low-privileged tenant can forge a certificate that impersonates arbitrary in-cluster service identities (e.g. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated principal with OpenShift/Kubernetes 'edit' (or 'admin') access in any single namespace of a cluster running the vulnerable hawtio-operator, because the operator's ClusterRole aggregates Hawtio CR permissions into those built-in roles; the attacker must be able to create/modify a namespaced Hawtio custom resource and set its Subject CN. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is internally consistent with the described flaw: an attacker needs only low privileges (namespace 'edit', an extremely common grant in multi-tenant clusters), no user interaction, and the scope change (S:C) is justified because a certificate minted in one namespace grants identity across the whole trust domain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the provided data; consult the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-78234 and Bugzilla 2524894 (https://bugzilla.redhat.com/show_bug.cgi?id=2524894) for the fixed release and apply it once published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all users and service accounts granted 'edit' permissions on Hawtio custom resources across affected clusters, focusing on shared/multi-tenant environments; document all namespace-level role bindings. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
OpenShift access token theft in hawtio-operator's cluster-mode deployment allows a low-privileged tenant to hijack OAuth
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wi
Denial-of-service in Undertow's WebSocket permessage-deflate implementation allows unauthenticated remote attackers to e
Confused deputy exploitation in hawtio-operator on OpenShift allows a namespace-scoped edit user to claim arbitrary exte
A resource exhaustion vulnerability exists in Undertow where remote attackers can send HTTP GET requests with multipart/
TLS private key exposure in hawtio-operator affects Red Hat Build of Apache Camel - Hawtio 4 deployments on OpenShift. W
HTTP request smuggling in Undertow's ChunkReader component enables unauthenticated remote attackers to inject out-of-syn
Same weakness CWE-295 – Improper Certificate Validation
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today