{"id":"CVE-2026-16242","title":"A flaw was found in the Konnectivity proxy-server configuration for hosted control planes","summary":"A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not va…","severity":"critical","cvss":9.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","cwe":["CWE-306"],"vendor":"Red Hat","product":"multicluster-engine/hypershift-rhel9-operator","affected":["multicluster-engine/hypershift-rhel9-operator (all versions)","multicluster-engine/hypershift-rhel9-operator (all versions)","multicluster-engine/hypershift-rhel9-operator (all versions)","multicluster-engine/hypershift-rhel9-operator (all versions)","multicluster-engine/hypershift-rhel9-operator (all versions)","multicluster-engine/hypershift-rhel9-operator (all versions)","multicluster-engine/hypershift-rhel9-operator (all versions)","openshift4/ose-hypershift-rhel8 (all versions)","openshift4/ose-hypershift-rhel9 (all versions)","openshift4/ose-hypershift-rhel9 (all versions)","openshift4/ose-hypershift-rhel9 (all versions)","openshift4/ose-hypershift-rhel9 (all versions)","openshift4/ose-hypershift-rhel9 (all versions)","openshift4/ose-hypershift-rhel9 (all versions)","openshift4/ose-hypershift-rhel9 (all versions)","openshift4/ose-hypershift-rhel9 (all versions)","openshift-logging/cluster-logging-rhel9-operator","multicluster-engine/cluster-curator-controller-rhel9","multicluster-engine/hypershift-addon-rhel9-operator","multicluster-engine/hypershift-cli-rhel9","multicluster-engine/managedcluster-import-controller-rhel9","oadp/oadp-hypershift-velero-plugin-rhel9","oadp/oadp-rhel9-operator","rhacm2/acm-multicluster-observability-addon-rhel9","rhacm2/acm-must-gather-rhel9","rhacm2/endpoint-monitoring-rhel9-operator","rhacm2/grafana-dashboard-loader-rhel9","rhacm2/metrics-collector-rhel9","rhacm2/multicluster-observability-rhel9-operator","rhacm2/rbac-query-proxy-rhel9","openshift4/ose-aws-ebs-csi-driver-rhel9-operator","openshift4/ose-aws-efs-csi-driver-rhel9-operator","openshift4/ose-azure-disk-csi-driver-rhel9-operator","openshift4/ose-azure-file-csi-driver-operator-rhel9","openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator","openshift4/ose-cluster-network-operator","openshift4/ose-cluster-network-rhel9-operator","openshift4/ose-cluster-node-tuning-rhel9-operator","openshift4/ose-cluster-storage-rhel9-operator","openshift4/ose-csi-driver-manila-rhel9-operator","openshift4/ose-openstack-cinder-csi-driver-rhel9-operator","openshift4/ose-powervs-block-csi-driver-rhel9-operator","openshift4/ose-smb-csi-driver-rhel9-operator"],"published":"2026-07-20","updated":"2026-09-14","sourceUpdated":"2026-09-14T15:17:04.540","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-16242","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:46885","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:47388","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:47728","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:47735","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:47949","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:47953","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:47974","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:48284","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:48657","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:48670","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:48676","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:48693","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:48699","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50758","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:56789","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:56912","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-16242","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502690","label":"secalert@redhat.com"},{"url":"https://github.com/openshift/hypershift/pull/9031","label":"secalert@redhat.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-07-21T14:56:23.371685Z"},"epss":0.00918,"epssPercentile":0.58515,"ingestedAt":"2026-08-02T12:18:23.811Z","slug":"CVE-2026-16242","body":"## Overview\n\nA flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":51.7,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}