CVE-2026-78234

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78234", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-08-27T10:25:52.070Z", "datePublished": "2026-09-08T11:27:52.787Z", "dateUpdated": "2026-09-08T17:14:44.894Z"}, "containers": {"cna": {"title": "Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbac-4/hawtio-gateway-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbac-4/hawtio-operator-bundle", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}, {"vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhbac-4/hawtio-rhel9", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-78234", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524894", "name": "RHBZ#2524894", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-09-08T10:55:10.366Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-295: Improper Certificate Validation", "workarounds": [{"lang": "en", "value": "Do not set spec.routeHostName to values outside the operator's own namespace service names. Restrict which users can create or modify Hawtio custom resources via RBAC. Audit existing Hawtio CR instances for unexpected routeHostName values and rotate any TLS certificates that may have been issued with incorrect Common Names."}], "timeline": [{"lang": "en", "time": "2026-05-20T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-08T10:55:10.366Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-08T17:14:44.894Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-08T12:18:30.594248Z", "id": "CVE-2026-78234", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T12:19:06.844Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-08T12:18:30.594248Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T12:19:03.227Z"}}], "cna": {"title": "Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "packageName": "rhbac-4/hawtio-gateway-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "packageName": "rhbac-4/hawtio-operator-bundle", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "packageName": "rhbac-4/hawtio-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-05-20T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-09-08T10:55:10.366Z", "value": "Made public."}], "datePublic": "2026-09-08T10:55:10.366Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-78234", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524894", "name": "RHBZ#2524894", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Do not set spec.routeHostName to values outside the operator's own namespace service names. Restrict which users can create or modify Hawtio custom resources via RBAC. Audit existing Hawtio CR instances for unexpected routeHostName values and rotate any TLS certificates that may have been issued with incorrect Common Names."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-09-08T17:14:44.894Z"}, "x_redhatCweChain": "CWE-295: Improper Certificate Validation"}}, "cveMetadata": {"cveId": "CVE-2026-78234", "state": "PUBLISHED", "dateUpdated": "2026-09-08T17:14:44.894Z", "dateReserved": "2026-08-27T10:25:52.070Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-09-08T11:27:52.787Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "affected", "packageName": "rhbac-4/hawtio-gateway-rhel9", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "affected", "packageName": "rhbac-4/hawtio-operator-bundle", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "affected", "packageName": "rhbac-4/hawtio-rhel9", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components."}], "id": "CVE-2026-78234", "lastModified": "2026-09-08T19:08:15.590", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78234", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-08T12:18:30.594248Z", "version": "2.0.3"}}]}, "published": "2026-09-08T12:16:59.560", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-78234"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524894"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "hawtio-operator: hawtio-operator: Service-CA signing oracle allows arbitrary-CN certificate issuance to namespace edit users", "id": "2524894", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524894"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-295", "details": ["A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components."], "mitigation": {"lang": "en:us", "value": "Do not set spec.routeHostName to values outside the operator's own namespace service names. Restrict which users can create or modify Hawtio custom resources via RBAC. Audit existing Hawtio CR instances for unexpected routeHostName values and rotate any TLS certificates that may have been issued with incorrect Common Names."}, "name": "CVE-2026-78234", "package_state": [{"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Affected", "impact": "important", "package_name": "rhbac-4/hawtio-gateway-rhel9", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Affected", "impact": "important", "package_name": "rhbac-4/hawtio-operator-bundle", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Affected", "impact": "important", "package_name": "rhbac-4/hawtio-rhel9", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}], "public_date": "2026-09-08T10:55:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-78234\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-78234"], "statement": "Red Hat has determined that this vulnerability is Important severity and not Critical because authentication is required. The hawtio-operator directly reads the cluster Service CA private key and issues certificates with an attacker-controlled Common Name, effectively providing a signing oracle to any namespace editor. Exploitation enables cross-tenant service impersonation and, via Jolokia MBean invocation on Java workloads, remote code execution. Red Hat recommends that the operator stop reading the Service CA signing key and instead use the Kubernetes CSR API with a dedicated signer or a Hawtio-private CA.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "product": "apache_camel_hawtio", "vendor": "redhat"}, {"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 96.0, "source": "matching"}]}, "original": {"product": "Red Hat build of Apache Camel - HawtIO 4", "source": "cna", "vendor": "Red Hat"}, "product": "build_of_apache_camel_-_hawtio", "vendor": "redhat"}], "created": "2026-09-08T12:30:17.811092+00:00", "updated": "2026-09-08T20:35:04.542422+00:00", "vendors": ["redhat", "redhat$PRODUCT$apache_camel_hawtio", "redhat$PRODUCT$build_of_apache_camel_-_hawtio"]}