CVE-2026-16242

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

State: Published
Severity: 9.4 Critical
Published: Jul 20, 2026
Updated: Sep 14, 2026
Reserved: Jul 20, 2026

Description

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

Scores

CVSS	Score	Vector	Source
3.1	9.4 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L	redhat

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
multicluster engine for Kubernetes 2.1Red Hat	1784905766 and laterNot affected
multicluster engine for Kubernetes 2.1Red Hat	1784905766 and laterNot affected
multicluster engine for Kubernetes 2.11Red Hat	1784945966 and laterNot affected
multicluster engine for Kubernetes 2.17Red Hat	1784856942 and laterNot affected
multicluster engine for Kubernetes 2.6Red Hat	1784905804 and laterNot affected
multicluster engine for Kubernetes 2.8Red Hat	1784905783 and laterNot affected
multicluster engine for Kubernetes 2.9Red Hat	1784905769 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat	1787001690 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat	1787055132 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat	1785534428 and laterNot affected
Red Hat OpenShift Container Platform 4.17Red Hat	1784914869 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat	1784912882 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat	1784913720 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat	1785288843 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat	1785301941 and laterNot affected
Red Hat OpenShift Container Platform 4.22Red Hat	1785192936 and laterNot affected
Logging Subsystem for Red Hat OpenShiftRed Hat
Multicluster Engine for KubernetesRed Hat
Multicluster Engine for KubernetesRed Hat
Multicluster Engine for KubernetesRed Hat
Multicluster Engine for KubernetesRed Hat
OpenShift API for Data ProtectionRed Hat
OpenShift API for Data ProtectionRed Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat Advanced Cluster Management for Kubernetes 2Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat

References

RHSA-2026:46885vendor-advisory
RHSA-2026:47388vendor-advisory
RHSA-2026:47728vendor-advisory
RHSA-2026:47735vendor-advisory
RHSA-2026:47949vendor-advisory
RHSA-2026:47953vendor-advisory
RHSA-2026:47974vendor-advisory
RHSA-2026:48284vendor-advisory
RHSA-2026:48657vendor-advisory
RHSA-2026:48670vendor-advisory
RHSA-2026:48676vendor-advisory
RHSA-2026:48693vendor-advisory
RHSA-2026:48699vendor-advisory
RHSA-2026:50758vendor-advisory
RHSA-2026:56789vendor-advisory
RHSA-2026:56912vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-16242vdb-entry
RHBZ#2502690issue-tracking
https://github.com/openshift/hypershift/pull/9031

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.