Bug 2502690 (CVE-2026-16242)

Summary: CVE-2026-16242 hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: crizzo, dfreiber, drow, dymurray, gparvin, jburrell, jcantril, jmatthew, rhaigner, rjohnson, rojacob, vkumar, whayutin
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-20 05:23:12 UTC 
A flaw was found in HyperShift's hosted control plane konnectivity-server configuration. The proxy-server is started without the --cluster-ca-cert flag, which means the agent-facing TLS listener is set to tls.NoClientCert and does not request or verify client certificates at all. An attacker with network access to the externally-exposed konnectivity cluster endpoint can connect with an arbitrary or self-signed certificate (or no certificate) and be added to the agent routing pool. Once in the routing pool, the attacker can intercept, modify, or drop control-plane-to-node traffic that the server routes through their connection, including kubectl exec/logs streams, kubelet API calls with pod specs containing secrets, service account tokens, and ConfigMap/Secret data. The fix adds --cluster-ca-cert referencing the existing per-cluster konnectivity CA bundle that is already mounted in the container.