CVE-2026-16242
CRITICAL
9.4
CVSS 3.1
Description
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
Metadata
Severity & Metrics
9.4
CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
SSVC — CISA Coordinator
Affected products (31)
| Vendor | Product | Platform | Versions |
|---|---|---|---|
| Red Hat | Logging Subsystem for Red Hat OpenShift | — | — |
| Red Hat | Multicluster Engine for Kubernetes | — | — |
| Red Hat | Multicluster Engine for Kubernetes | — | — |
| Red Hat | Multicluster Engine for Kubernetes | — | — |
| Red Hat | Multicluster Engine for Kubernetes | — | — |
| Red Hat | multicluster engine for Kubernetes 2.10 | — | 1784905766 < * |
| Red Hat | multicluster engine for Kubernetes 2.10 | — | 1784905766 < * |
| Red Hat | OpenShift API for Data Protection | — | — |
| Red Hat | OpenShift API for Data Protection | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
Weakness (CWE)
| CWE | Source | Description |
|---|---|---|
| CWE-306 | cna | Missing Authentication for Critical Function |
CVSS scores (1)
| Score | Severity | Version | Source | Vector |
|---|---|---|---|---|
| 9.4 | CRITICAL | 3.1 | cna | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
References (5)