CVE-2026-16242
Received Received - Intake

Konnectivity Proxy Server Client Certificate Validation Bypass

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: Red Hat, Inc.

Description
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-16242
EUVD
EUVD-2026-45897

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat konnectivity *
redhat hypershift *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Konnectivity proxy-server used by hosted control planes. The agent-facing listener was started without the --cluster-ca-cert flag, so client certificates were not validated. This allowed unauthenticated remote attackers to connect as agents, join the routing pool, and potentially intercept, modify, or drop control-plane-to-node traffic.

Detection Guidance

Check if the Konnectivity proxy-server is running without the --cluster-ca-cert flag. Inspect the server logs for client certificate validation failures or unauthenticated agent connections. Use network scanning tools to verify if the Konnectivity cluster endpoint is exposed to unauthorized access.

Impact Analysis

An attacker who exploits this could access sensitive data like kubectl exec/logs streams, kubelet API calls with pod secrets, service account tokens, and ConfigMap/Secret data. They could also disrupt control-plane communications by proxying, inspecting, modifying, or dropping traffic between the control plane and nodes.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of personal or health data through intercepted traffic may result in non-compliance with these regulations, potentially leading to legal and financial penalties.

Mitigation Strategies

Update the Konnectivity proxy-server configuration to include the --cluster-ca-cert flag pointing to the cluster's CA bundle. Restart the server to enforce client certificate validation. Ensure the Konnectivity CA bundle is properly mounted and accessible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16242. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart