VDB
RHSA-2026:47728
RHSA-2026:47728
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-gcp-cluster-api-controllers-rhel9@sha256:cd676aaf972e9042477d2fe10dba37f5584c9538565fbcf7a72987e8b2c1a326_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-tools-rhel9@sha256:d1282d448241e4a12f9bbc15cf21cc9cfe72e870a8a2c59e60cbcc1f5fd3c43b_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-machine-approver-rhel9@sha256:e02a46e3b0228dbc6778b6c42d7883171342128f40c5a40cefc44715f20479cc_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-operator-registry-rhel9@sha256:b067e4731096824ffdfdb3f65fc056817b5e008adc3c7fdd8e446cced148588b_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-machine-config-rhel9-operator@sha256:ac769704a792dbd6ef4925d31795a0a7f4d164f7a6619865a9fb87c3688907b1_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-vsphere-csi-driver-syncer-rhel9@sha256:33f770c4367ada5b653f804ffe4873001d4fa072bbf87e6667e8a231f3a0eb1c_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-service-ca-rhel9-operator@sha256:ede865517ef345c8c44486930f57c5cd9953d45d3ccdcb67a2137627385ba87b_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-pd-csi-driver-operator-rhel9@sha256:aec2f87c861b6fc597504e207afb8571721f028ce3abdd5283144b9f79e76c6e_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-proxy-rhel9@sha256:1be0d6cc64e99e80cb2a727cd9add6e395a2f6811b66c8455e70014a45721c0e_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-service-ca-rhel9-operator@sha256:1a61e1350446d1d23c8dffbe5f4b8213ef228e4d1e9c72f0aa9ec2e8e8130581_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-csr-approver-rhel9@sha256:a65be0af42c8c7992d5e97886d22e080ca56a50f57fef7e407d3ab7280416d20_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cli-artifacts-rhel9@sha256:e768923feb5f5400de09f87408578f5d2f8b60a860918fa85e306acfa8e8a229_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator@sha256:554076b0de745142ec0441948e3cf53f256043d2cdd1c8fffb80f91fdf0780e9_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-manila-rhel9@sha256:772720cea631c5c50e10ee79eeec208098166d5428e894f1f5ebbc067f232b99_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-shared-resource-rhel9-operator@sha256:5b6f3220ca7cf1f4d1b5b392ef3c54a01d086184f19e55da45416949ad46b2de_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-dns-rhel9-operator@sha256:7a7578ad21c89afbcade6a4a2c94ff2e5e93287cccbee78849240f9e3828bcf2_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-networking-console-plugin-rhel9@sha256:25243d4f5bdd7c4b22e3e6089508cc6eda8a2c96aaf4f03f30cc71295dacb9ca_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-control-plane-machine-set-rhel9-operator@sha256:ea4520563dffaae811e8b9dae6be5d83300776a9f3cd40c4b8e6969511f5acdd_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-network-interface-bond-cni-rhel9@sha256:96c54f0c1599359bc64809cc055c45a713373369abbf1af0ad81d03f1e711339_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | * |
| Red Hat | registry.redhat.io/openshift4/ose-oauth-apiserver-rhel9@sha256:d1c8073ee4d600806b512043f7fdd8cd56365e3d933f1d1a1ca5d89a9c6a9de7_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | * |
…and 639 more
Timeline
- Aug 6, 2026 CVE Published
- Sep 9, 2026 CVE Updated
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Distribution Patch
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
- Sep 9, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:47728 advisory
- https://access.redhat.com/security/cve/CVE-2026-12151 advisory
- https://access.redhat.com/security/cve/CVE-2026-13676 advisory
- https://access.redhat.com/security/cve/CVE-2026-16242 advisory
- https://access.redhat.com/security/cve/CVE-2026-26996 advisory
- https://access.redhat.com/security/cve/CVE-2026-33186 advisory
- https://access.redhat.com/security/cve/CVE-2026-35469 advisory
- https://access.redhat.com/security/cve/CVE-2026-40895 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-46579 advisory
- https://access.redhat.com/security/cve/CVE-2026-9697 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47728.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2490018 issue
- https://www.cve.org/CVERecord?id=CVE-2026-9697 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-9697 advisory
- https://cna.openjsf.org/security-advisories.html advisory
- https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2489980 issue
- https://www.cve.org/CVERecord?id=CVE-2026-12151 advisory
…and 37 more