A critical vulnerability in the Red Hat Hawtio operator allows authenticated users to impersonate internal cluster services, posing a severe risk to internal service-to-service authentication.

The Hawtio operator improperly handles the OpenShift Service CA private signing key, allowing users with namespaced edit permissions to mint certificates with arbitrary subjects. An authenticated attacker can use these certificates to impersonate cluster services to components that trust the Service CA, such as Jolokia agents.

The ability to impersonate internal services allows an attacker to bypass authentication mechanisms for critical cluster components. With a CVSS score of 9.9, this vulnerability could lead to unauthorized remote code execution via MBean invocation on Java workloads. The risk includes total compromise of internal service communications and data exfiltration.

Immediate Action: Configure the software to use the Kubernetes CSR API instead of directly reading the signing key and restrict RBAC permissions for modifying custom resources.

Proactive Monitoring: Audit existing cluster instances to identify and rotate any suspect TLS certificates that may have been generated through this vulnerability.

Compensating Controls: Implement strict RBAC policies to ensure that only authorized personnel have edit access to Hawtio custom resources, and monitor for unauthorized certificate signing requests.

Public Exploit Available: No.

Due to the severity of this flaw, administrators must prioritize the recommended configuration changes to the Hawtio operator. Rotating certificates and tightening RBAC permissions are essential steps to ensure that the cluster remains protected against unauthorized impersonation attacks.