hawtio-operator CVE-2026-78234

Requires an authenticated principal with OpenShift/Kubernetes 'edit' (or 'admin') access in any single namespace of a cluster running the vulnerable hawtio-operator, because the operator's ClusterRole aggregates Hawtio CR permissions into those built-in roles; the attacker must be able to create/modify a namespaced Hawtio custom resource and set its Subject CN. Exploitation is limited to actors who already possess in-cluster credentials (a tenant/insider or a compromised low-privilege account) - it is not exploitable by a fully anonymous external attacker - and the impact depends on target components actually trusting the OpenShift Service CA for client authentication (e.g. Jolokia agents). Clusters that do not deploy this operator, or that have stripped the RBAC aggregation, are not exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) is internally consistent with the described flaw: an attacker needs only low privileges (namespace 'edit', an extremely common grant in multi-tenant clusters), no user interaction, and the scope change (S:C) is justified because a certificate minted in one namespace grants identity across the whole trust domain. The high C/I/A impacts are credible because service impersonation can lead to data theft, request forgery, and disruption of trusted components such as Jolokia (which can expose JMX operations). There is no EPSS score, no KEV listing, and no public proof-of-concept provided, so real-world exploitation is presently unproven - but the low complexity and the fact that the prerequisite (edit access) is routinely delegated to developers mean any organization running multi-tenant OpenShift with this operator should treat it as urgent rather than theoretical. The dominant caveat is that exploitation is entirely internal to a cluster (a hostile or compromised tenant), not literally internet-facing despite AV:N, which somewhat narrows the practical attacker population to those who already have a foothold or legitimate low-tier access.

A developer with routine 'edit' rights in a single project namespace creates a Hawtio custom resource whose Subject Common Name is set to the identity of a privileged in-cluster service. The operator dutifully signs that CN with the OpenShift Service CA key and returns a valid client certificate, which the attacker then presents to a Service-CA-trusting peer (such as a Jolokia agent) to impersonate that service and issue authorized operations. No public exploit code is currently identified, but the attack requires only standard Kubernetes/OpenShift API access and no special tooling.