VDB
RHSA-2026:48676
RHSA-2026:48676
PUBLISHED
CVSS 8.100000381469727 HIGH
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-deployer-rhel9@sha256:6611256d98e771fce9c1fde727ca7d7d571ee09c67dea9cf4bcf5791eabdb597_arm64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-insights-rhel9-operator@sha256:265c26f11ff682bb2001e4df8450f2b7ea516ae45a5d8accade8a495cb0b9535_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator@sha256:2b06c133ec5130fb886cb542b5ccc400668cda58422468b3cabee8c24a48ed40_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9@sha256:21792feafe8e73e7bf42db2a3483168f7caea58d16d93d54a9175c5f9d726e44_ppc64le as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-baremetal-machine-controllers-rhel9@sha256:ceca92090f554a02a396b8c700ba2b6f5a600c5aa7acb90ce342cbc5dfa0380e_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-azure-file-csi-driver-operator-rhel9@sha256:de2378d36176a95bfeee48c610559ea05347dce4bf433349e115cd42e23c8786_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-bootstrap-rhel9@sha256:57e6e57e023dfd01fa271d11d4e727b09990c745e137465f7bff1b3d172247cd_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-resizer-rhel9@sha256:4bcf2e69f516c65fc674729d15d50d371afeb8970b2f5a9ad899717e0a15eb00_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-snapshot-metadata-rhel9@sha256:70e60288f96e117e40e589795c02db70773f1bb7f96fc01d82b8b9efc0d32e46_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9@sha256:3a0712e5aa1c98cf804524d3c90d7f9a9324bbcecd516ff3b2034b12f60c77af_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel9@sha256:c60bd29f24f0165c60f12d2339e7ce3bcde33016524f50d31b191972a9dd8787_s390x as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-version-rhel9-operator@sha256:365119ab9bad6f475a401692f96785b62f902dfc2c57eae5a3d8012087113b73_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-telemeter-rhel9@sha256:1ac5c3dc9c2633590a0f0b83e572294af04b7dab35f33f4a23c83c3bfaf19313_s390x as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-openshift-controller-manager-rhel9-operator@sha256:630d98a2e97c853e38bdf86e5149eee33c11b1816e4ddbe115b7b4109fd5a920_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-policy-controller-rhel9@sha256:46c2938a9497342dbc87cf9b9b1acdabe5f0ecc7edb690e3a64bc87e04170ff6_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-keepalived-ipfailover-rhel9@sha256:86b629a6b6d218cf90f13c407bdd00bb88b1422f1236aa181b322181dca5efc2_arm64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-networkpolicy-rhel9@sha256:5b4f674c4b16d0202aae9a0dc287d0649a9cc07e9cc8e6c767baac6123114456_s390x as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-openstack-cinder-csi-driver-rhel9@sha256:c41acf2f080afd738c26b3e2d8ab3136519e89a1f1911b4ce0d8157ef294d85e_amd64 as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-workload-identity-federation-webhook-rhel9@sha256:ea5c00b205023b02d5d7e3296ccd5f405e05f0f8a7a68a972d772adf41c417bf_amd64 as a component of Red Hat OpenShift Container Platform 4.2 | * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:1441c96620c21045e86ac9d8bccb80c69136529885a06c729e33cab76e814ad0_ppc64le as a component of Red Hat OpenShift Container Platform 4.20 | *, *, * |
…and 1306 more
Timeline
- Aug 4, 2026 CVE Published
- Sep 24, 2026 CVE Updated
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Distribution Patch
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
- Sep 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:48676 advisory
- https://access.redhat.com/security/cve/CVE-2026-16242 advisory
- https://access.redhat.com/security/cve/CVE-2026-34986 advisory
- https://access.redhat.com/security/cve/CVE-2026-49978 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_48676.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2502690 issue
- https://www.cve.org/CVERecord?id=CVE-2026-16242 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-16242 advisory
- https://github.com/openshift/hypershift/pull/9031 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2455470 issue
- https://www.cve.org/CVERecord?id=CVE-2026-34986 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-34986 advisory
- https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8 advisory
- https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2500695 issue
- https://www.cve.org/CVERecord?id=CVE-2026-49978 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49978 advisory
- https://github.com/cure53/DOMPurify/commit/ca30f070c360df162a3e3848e80e6fd3c9e74bff advisory
- https://github.com/cure53/DOMPurify/releases/tag/3.4.7 advisory
…and 1 more