Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-78234, describes how the hawtio-operator reads the OpenShift Service CA private signing key and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. This allows any user with edit access to a Hawtio CR to obtain a Service-CA-signed certificate with an arbitrary subject, enabling impersonation.
My analysis focused on identifying the code responsible for these actions within the hawtio/hawtio-operator repository. I started by examining the pkg/controller/hawtio/ directory, which contains the core reconciliation logic for the Hawtio custom resource.
pkg/controller/hawtio/certificate.go: This file contains functions explicitly for certificate generation. I identified generateCASignedCertSecret and its underlying helper generateCertificateSecret as directly taking a commonName parameter and using it without validation to create the certificate's subject. These functions also accept a caSecret containing the CA's private key for signing.
pkg/controller/hawtio/hawtio_controller_openshift.go: This file proved to be the crucial link. The newSignedCertificateSecret function within this file performs two key vulnerable actions:
signing-key secret from the openshift-service-ca namespace. This directly fulfills the 'reads the OpenShift Service CA private signing key' part of the vulnerability.ClientCertCommonName from the Hawtio custom resource (hawtio.Spec.Auth.ClientCertCommonName). This is the 'Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource' part.generateCASignedCertSecret (from certificate.go), passing the retrieved Service CA private key and the user-controlled common name. This completes the chain, allowing the operator to act as a signing oracle.Therefore, hawtio.newSignedCertificateSecret orchestrates the vulnerability by fetching the sensitive key and user input, while hawtio.generateCASignedCertSecret and hawtio.generateCertificateSecret are the functions that perform the actual vulnerable certificate signing with the arbitrary common name.
hawtio.newSignedCertificateSecretpkg/controller/hawtio/hawtio_controller_openshift.go
hawtio.generateCASignedCertSecretpkg/controller/hawtio/certificate.go
hawtio.generateCertificateSecretpkg/controller/hawtio/certificate.go