CyberRota Analysis
AI-GeneratedA critical vulnerability exists in the hawtio-operator, allowing users with edit access in any namespace to exploit the OpenShift Service CA private signing key to mint client certificates with arbitrary subject names. This enables unauthorized impersonation of any in-cluster service identity, potentially compromising trust relationships with components that rely on Service CA for authentication. Organizations using OpenShift should prioritize remediation to prevent potential security breaches stemming from this flaw.
Original NVD Description
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.