Konnectivity Vulnerability Lets Unauthenticated Attackers Intercept Control-Plane Traffic
Do Son 
- CVE: CVE-2026-16242
- CVSS: 9.4 (Critical · CVSSv3)
- Product: Red Hat Logging Subsystem for Red Hat OpenShift
- Impact: Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates
- Status: No confirmed exploitation yet
- EPSS: 0.4% (30-day)
- Action: See vendor advisory
A critical Konnectivity vulnerability lets a remote attacker slip into a cluster without any credentials. Tracked as CVE-2026-16242, it carries a CVSS score of 9.4. The flaw sits in the Konnectivity proxy-server used by hosted control planes. In effect, an unauthenticated agent can join the routing pool and tamper with control-plane traffic.
TL;DR
The Konnectivity agent listener launched without client-certificate validation. As a result, a remote attacker who reaches the endpoint can connect as a trusted agent. From there, they can proxy, inspect, modify, or drop control-plane-to-node traffic.
Why it matters
The control plane is the brain of a cluster. Therefore, tampering with its traffic threatens confidentiality, integrity, and availability at once. Because the agent endpoint is exposed for worker agents, the attack surface is reachable by design. A CVSS 9.4 rating reflects that serious impact.
How the attack works
The problem is a missing authentication check. The agent-facing listener started without the cluster CA certificate. It also skipped token-based agent authentication. Consequently, the server never validated client certificates.
An attacker who can reach the agent endpoint connects without a signed certificate. That untrusted agent then enrolls in the routing pool. When the proxy picks that stream for a control-plane dial, the attacker gains a foothold on the path. At that point, they can read or alter traffic between the control plane and nodes.
Affected systems
The flaw affects hosted control planes that run the misconfigured Konnectivity proxy-server. For exact affected releases and product mapping, review the Red Hat advisory for CVE-2026-16242. No public exploitation has been confirmed at this time.
Patch and mitigation steps
Apply the vendor update that configures Konnectivity agent authentication once available. Until then, lock down network access to the agent endpoint. Allow only trusted worker networks to reach it.
- For NodePort or LoadBalancer publishing, limit ingress to port 8091 to worker node subnet ranges.
- For Route-based publishing, restrict the Konnectivity route to trusted networks.
These controls lower exposure. However, they do not replace proper agent certificate or token authentication. So patch as soon as the fix lands.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
