# CVE-2026-78234: Red Hat hawtio-operator Service CA signing oracle allows arbitrary certificate issuance

Source: https://junglewise.ai/threats/cve-2026-78234-red-hat-hawtio-operator-service-ca-signing-oracle-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78234 · Severity: critical · CVSS 9.9 · Published 2026-09-08

The hawtio-operator, a Kubernetes component that manages the Hawtio Java web console, contains a critical vulnerability in how it handles certificate signing. Any user with edit permissions in a Kubernetes namespace can trick the operator into creating fraudulent SSL certificates with arbitrary identities, allowing them to impersonate any in-cluster service. This could enable attackers to bypass security controls, steal data, or execute code on Java applications using the Jolokia interface.

Technologies: [Red Hat Hawtio-Operator](https://junglewise.ai/threats/technologies/hawtio-operator). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-78234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78234 being exploited in the wild.

**How severe is CVE-2026-78234?** Critical severity, with a CVSS score of 9.9, published 8 September 2026.

**Which products and versions are affected?** Red Hat hawtio-operator.

**Is there a fix for CVE-2026-78234?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78234 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-78234?** Check whether you run Red Hat Hawtio-Operator. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a certificate validation bypass (CWE-295) where hawtio-operator directly reads the OpenShift Service CA private signing key and uses it to issue client certificates with a Subject Common Name (CN) supplied by the attacker via Hawtio custom resource (CR) definitions. An attacker with edit access in any namespace can create or modify a Hawtio CR to request a certificate with an arbitrary CN, exploiting the fact that the operator's ClusterRole aggregates Hawtio permissions into the cluster-wide edit and admin roles. The issued certificate, being Service-CA-signed, is trusted by in-cluster components for client authentication. This allows impersonation of any service identity to Jolokia agents and other components that trust the Service CA, potentially enabling remote code execution on Java workloads. The attack requires low privilege (namespace edit access) and network reachability, with no user interaction needed. Red Hat recommends the operator use the Kubernetes CSR API with a dedicated signer or a Hawtio-private CA instead of directly reading the Service CA key.

## Affected products

- Red Hat hawtio-operator

## Timeline

- 2026-09-08: disclosed
- other: Red Hat internally rated as Important (not Critical) due to authentication requirement, though impact severity remains high

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-78234](https://access.redhat.com/security/cve/CVE-2026-78234)

## Related threats

- [Red Hat hawtio-operator sensitive information logging](https://junglewise.ai/threats/cve-2026-81320-red-hat-hawtio-operator-sensitive-information-logging)
- [hawtio-operator confused deputy in Route hostname validation](https://junglewise.ai/threats/cve-2026-81303-hawtio-operator-confused-deputy-in-route-hostname-validation)
- [Hawtio-operator privilege escalation via overpermissioned ClusterRole](https://junglewise.ai/threats/cve-2026-77968-hawtio-operator-privilege-escalation-via-overpermissioned)