Executive brief
The hawtio-operator, a Kubernetes component that manages the Hawtio Java web console, contains a critical vulnerability in how it handles certificate signing. Any user with edit permissions in a Kubernetes namespace can trick the operator into creating fraudulent SSL certificates with arbitrary identities, allowing them to impersonate any in-cluster service. This could enable attackers to bypass security controls, steal data, or execute code on Java applications using the Jolokia interface.
Technical details
The vulnerability is a certificate validation bypass (CWE-295) where hawtio-operator directly reads the OpenShift Service CA private signing key and uses it to issue client certificates with a Subject Common Name (CN) supplied by the attacker via Hawtio custom resource (CR) definitions. An attacker with edit access in any namespace can create or modify a Hawtio CR to request a certificate with an arbitrary CN, exploiting the fact that the operator's ClusterRole aggregates Hawtio permissions into the cluster-wide edit and admin roles. The issued certificate, being Service-CA-signed, is trusted by in-cluster components for client authentication. This allows impersonation of any service identity to Jolokia agents and other components that trust the Service CA, potentially enabling remote code execution on Java workloads. The attack requires low privilege (namespace edit access) and network reachability, with no user interaction needed. Red Hat recommends the operator use the Kubernetes CSR API with a dedicated signer or a Hawtio-private CA instead of directly reading the Service CA key.
Affected products
- Red Hat hawtio-operator
Timeline
- 2026-09-08: disclosed
- other: Red Hat internally rated as Important (not Critical) due to authentication requirement, though impact severity remains high