Privilege Escalation in Konflux CI Due to TLS Certificate Verification Bypass

Executive Summary

This vulnerability is a privilege escalation flaw in the konflux-ci project. It occurs when the user interface proxy disables TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority. An adjacent network attacker can intercept traffic, capture cluster-scoped authentication tokens with user impersonation rights, and gain full administrative control of the cluster.

Useful 0 Not Useful 0

Detection Guidance

Check if the konflux-ui proxy is running in your cluster and inspect its configuration for disabled TLS verification. Look for the generate-proxy-config.sh script in the proxy's init container logs to confirm if it skips TLS checks. Monitor network traffic for unencrypted or intercepted requests between the proxy and backend services like Tekton Results or KubeArchive.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker to gain full administrative access to your Kubernetes cluster. This includes the ability to impersonate any user or group with cluster-admin privileges, potentially leading to unauthorized data access, modification, or deletion. It specifically affects non-OpenShift clusters like Kind, Kubernetes, EKS, and GKE.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA. If exploited, it allows attackers to gain administrative control of the cluster, potentially exposing personal or health-related data stored in backends like Tekton Results or KubeArchive. Non-compliance risks include data breaches, unauthorized access, and failure to meet security controls for data protection.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the fix by republishing the backend's TLS certificate into a ConfigMap and mounting it into the proxy. Tighten RBAC permissions to restrict group impersonation. Ensure the proxy enforces TLS verification by default and logs insecure path usage. Avoid using non-OpenShift clusters without proper service CA configurations.

Useful 0 Not Useful 0