VDB

CVE-2026-16242

CVE-2026-16242 PUBLISHED CVSS 9.4 CRITICAL

Reported by redhat · Published July 20, 2026

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

Risk Scores

CVSS 3.1
9.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected Products

VendorProductVersions
Red Hatmulticluster engine for Kubernetes 2.11784905766
Red Hatmulticluster engine for Kubernetes 2.11784905766
Red Hatmulticluster engine for Kubernetes 2.111784945966
Red Hatmulticluster engine for Kubernetes 2.171784856942
Red Hatmulticluster engine for Kubernetes 2.61784905804
Red Hatmulticluster engine for Kubernetes 2.81784905783
Red Hatmulticluster engine for Kubernetes 2.91784905769
Red HatRed Hat OpenShift Container Platform 4.161785534428
Red HatRed Hat OpenShift Container Platform 4.171784914869
Red HatRed Hat OpenShift Container Platform 4.181784912882
Red HatRed Hat OpenShift Container Platform 4.191784913720
Red HatRed Hat OpenShift Container Platform 4.21785288843
Red HatRed Hat OpenShift Container Platform 4.211785301941
Red HatRed Hat OpenShift Container Platform 4.221785192936
Red HatLogging Subsystem for Red Hat OpenShift
Red HatMulticluster Engine for Kubernetes
Red HatMulticluster Engine for Kubernetes
Red HatMulticluster Engine for Kubernetes
Red HatMulticluster Engine for Kubernetes
Red HatOpenShift API for Data Protection

…and 69 more

Timeline

  • Jul 20, 2026 EPSS Score
  • Jul 20, 2026 Coalition ESS Score
  • Jul 20, 2026 CVE Published
  • Aug 7, 2026 EPSS Score
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›