PT-2026-61539 · Unknown · Konnectivity Proxy-Server

CVE-2026-16242 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Konnectivity proxy-server (affected versions not specified)

Description A flaw in the configuration of the proxy-server for hosted control planes allows the agent-facing listener to start without the --cluster-ca-cert flag and without token-based agent authentication. Consequently, client certificates are not validated, enabling a remote attacker with access to the Konnectivity cluster endpoint to connect as an unauthenticated agent. This allows the attacker to join the routing pool and potentially proxy, inspect, modify, or drop traffic between the control plane and the nodes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-16242

Affected Products

Konnectivity Proxy-Server

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-16242 · Security Note
• https://github.com/openshift/hypershift/pull/9031 · Note
• https://twitter.com/HugoValters/status/2079261555036938404 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2502690 · Note
• https://twitter.com/OrizonCyber/status/2079121648314146990 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2026-16242 · Note
• https://twitter.com/VulmonFeeds/status/2079163718349312106 · Twitter Post
• https://twitter.com/vulnipulse/status/2079338132106080411 · Twitter Post