CVE-2026-16242: Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates
A flaw was found in HyperShift's hosted control plane konnectivity-server configuration. The proxy-server is started without the --cluster-ca-cert flag, which means the agent-facing TLS listener is set to tls.NoClientCert and does not request or verify client certificates at all. An attacker with network access to the externally-exposed konnectivity cluster endpoint can connect with an arbitrary or self-signed certificate (or no certificate) and be added to the agent routing pool. Once in the routing pool, the attacker can intercept, modify, or drop control-plane-to-node traffic that the server routes through their connection, including kubectl exec/logs streams, kubelet API calls with pod specs containing secrets, service account tokens, and ConfigMap/Secret data. The fix adds --cluster-ca-cert referencing the existing per-cluster konnectivity CA bundle that is already mounted in the container.
Other sources
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Start konnectivity proxy-server with the --cluster-ca-cert flag pointing to the existing per-cluster konnectivity CA bundle that is already mounted in the container, so the agent-facing TLS listener validates client certificates instead of using tls.NoClientCert.
HyperShift / konnectivity proxy-server (agent-facing listener) --cluster-ca-cert = <path to existing per-cluster konnectivity CA bundle already mounted in the container>
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16242?
CVE-2026-16242 has a critical severity rating of 9.4.
How do I fix CVE-2026-16242?
To fix CVE-2026-16242, configure the konnectivity proxy-server to use the --cluster-ca-cert flag to enable client certificate validation.
What are the potential impacts of CVE-2026-16242?
CVE-2026-16242 may allow an unauthorized attacker to access the konnectivity proxy-server, possibly compromising sensitive data.
Which software is affected by CVE-2026-16242?
CVE-2026-16242 affects Kubernetes HyperShift and the Kubernetes Konnectivity proxy-server.
What is the nature of the flaw in CVE-2026-16242?
The flaw in CVE-2026-16242 involves the konnectivity proxy-server accepting agent connections without validating client certificates.