by Kastro CVE-2026-16242
Red Hat multicluster engine for Kubernetes 2.1 — Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates
Description · from the CVE record
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
Affected
ProductAffectedFixed inSource
multicluster engine for Kubernetes 2.1see advisory1784905766CNA
multicluster engine for Kubernetes 2.1see advisory1784905766CNA
multicluster engine for Kubernetes 2.11see advisory1784945966CNA
multicluster engine for Kubernetes 2.17see advisory1784856942CNA
multicluster engine for Kubernetes 2.6see advisory1784905804CNA
multicluster engine for Kubernetes 2.8see advisory1784905783CNA
multicluster engine for Kubernetes 2.9see advisory1784905769CNA
Red Hat OpenShift Container Platform 4.14see advisory1787001690CNA
Red Hat OpenShift Container Platform 4.15see advisory1787055132CNA
Red Hat OpenShift Container Platform 4.16see advisory1785534428CNA
Red Hat OpenShift Container Platform 4.17see advisory1784914869CNA
Red Hat OpenShift Container Platform 4.18see advisory1784912882CNA
Scores by source
redhat (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total