Privilege Escalation Vulnerability in Konflux-CI
CVE-2026-117681

8HIGH

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-117681?

A flaw exists within Konflux-CI that enables privilege escalation due to the automatic disabling of Transport Layer Security (TLS) certificate verification for connections to internal backend services. This issue arises in environments that do not have a default service certificate authority. The user interface proxy includes a cluster-scoped authentication token with user impersonation rights, allowing an adjacent network attacker to intercept traffic. By doing so, the attacker could capture credentials and potentially gain full administrative control over the cluster.

References

https://access.redhat.com/security/cve/CVE-2026-117681
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2563233
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Aditya Amol Kuchekar (dev-aditya-hub from GitHub: @dev-aditya-hub) for reporting this issue.
.