Security Flaw in Konnectivity Proxy-Server Configuration for OpenShift by Red Hat
CVE-2026-16242

9.4CRITICAL

Key Information:

Vendor

Red Hat
Status
Multicluster Engine For Kubernetes 2.1
Multicluster Engine For Kubernetes 2.11.0
Multicluster Engine For Kubernetes 2.17
Multicluster Engine For Kubernetes 2.6
Vendor
CVE Published:
20 July 2026

What is CVE-2026-16242?

A configuration issue was identified in the Konnectivity proxy-server used by hosted control planes in OpenShift. The agent-facing listener operates without properly validating client certificates due to the absence of necessary configurations such as --cluster-ca-cert and token-based authentication. This oversight enables unauthenticated external attackers with access to the Konnectivity cluster endpoint to connect as unauthorized agents, thereby risking exposure to sensitive control-plane-to-node traffic. Such an attacker could potentially manipulate routing pools, leading to data inspection or interception.

Affected Version(s)

multicluster engine for Kubernetes 2.1 1784905766

multicluster engine for Kubernetes 2.1 1784905766

multicluster engine for Kubernetes 2.11.0 1784945966

References

https://access.redhat.com/errata/RHSA-2026:46885
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47388
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47728
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Microsoft Security Research (MSRC) (Microsoft) for reporting this issue.
.