Is CVE-2026-78234 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78234 being exploited in the wild.

How severe is CVE-2026-78234?

Critical severity, with a CVSS score of 9.9, published 8 September 2026.

Is there a fix for CVE-2026-78234?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78234 attacked?

It is attacked over the network.

Am I affected by CVE-2026-78234?

Check whether you run Red Hat Hawtio-Operator. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78234: Red Hat hawtio-operator Service CA signing oracle allows arbitrary certificate issuance

CVE-2026-78234 · Severity: critical · CVSS 9.9 · Published 2026-09-08

The hawtio-operator, a Kubernetes component that manages the Hawtio Java web console, contains a critical vulnerability in how it handles certificate signing. Any user with edit permissions in a Kubernetes namespace can trick the operator into creating fraudulent SSL certificates with arbitrary identities, allowing them to impersonate any in-cluster service. This could enable attackers to bypass security controls, steal data, or execute code on Java applications using the Jolokia interface.

Technologies: Red Hat Hawtio-Operator. Vendors: Red Hat.

Quick answers

Is CVE-2026-78234 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78234 being exploited in the wild.
How severe is CVE-2026-78234?: Critical severity, with a CVSS score of 9.9, published 8 September 2026.
Which products and versions are affected?: Red Hat hawtio-operator.
Is there a fix for CVE-2026-78234?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78234 attacked?: It is attacked over the network.
Am I affected by CVE-2026-78234?: Check whether you run Red Hat Hawtio-Operator. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a certificate validation bypass (CWE-295) where hawtio-operator directly reads the OpenShift Service CA private signing key and uses it to issue client certificates with a Subject Common Name (CN) supplied by the attacker via Hawtio custom resource (CR) definitions. An attacker with edit access in any namespace can create or modify a Hawtio CR to request a certificate with an arbitrary CN, exploiting the fact that the operator's ClusterRole aggregates Hawtio permissions into the cluster-wide edit and admin roles. The issued certificate, being Service-CA-signed, is trusted by in-cluster components for client authentication. This allows impersonation of any service identity to Jolokia agents and other components that trust the Service CA, potentially enabling remote code execution on Java workloads. The attack requires low privilege (namespace edit access) and network reachability, with no user interaction needed. Red Hat recommends the operator use the Kubernetes CSR API with a dedicated signer or a Hawtio-private CA instead of directly reading the Service CA key.

Affected products

Red Hat hawtio-operator

Timeline

2026-09-08: disclosed
other: Red Hat internally rated as Important (not Critical) due to authentication requirement, though impact severity remains high

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.