Skip to content
Fencer Vulns
critical 9.4

CVE-2026-16242 json

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

published 2026-07-20 3 mo ago modified 2026-09-14 56 d ago also EUVD-2026-45897

cvss
9.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

Patch / fix

  • Red Hat multicluster engine for Kubernetes 2.1 1784905766
  • Red Hat multicluster engine for Kubernetes 2.11 1784945966
  • Red Hat multicluster engine for Kubernetes 2.17 1784856942
  • Red Hat multicluster engine for Kubernetes 2.6 1784905804
  • Red Hat multicluster engine for Kubernetes 2.8 1784905783
  • Red Hat multicluster engine for Kubernetes 2.9 1784905769
  • Red Hat Red Hat OpenShift Container Platform 4.14 1787001690
  • Red Hat Red Hat OpenShift Container Platform 4.15 1787055132
  • Red Hat Red Hat OpenShift Container Platform 4.16 1785534428
  • Red Hat Red Hat OpenShift Container Platform 4.17 1784914869
  • Red Hat Red Hat OpenShift Container Platform 4.18 1784912882
  • Red Hat Red Hat OpenShift Container Platform 4.19 1784913720
  • Red Hat Red Hat OpenShift Container Platform 4.20 1785288843
  • Red Hat Red Hat OpenShift Container Platform 4.21 1785301941
  • Red Hat Red Hat OpenShift Container Platform 4.22 1785192936

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-16242 updated cvss 9.4

hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates

  • Red Hat multicluster engine for Kubernetes 2.1 multicluster-engine/hypershift-rhel9-operator 1784905766
    fixed: vendor fix RHSA-2026:46885
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hypershift-rhel9-operator 1784905804
    fixed: vendor fix RHSA-2026:47949
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hypershift-rhel9-operator 1784905783
    fixed: vendor fix RHSA-2026:47735
  • Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hypershift-rhel9-operator 1784905769
    fixed: vendor fix RHSA-2026:47953
  • Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/hypershift-rhel9-operator 1784945966
    fixed: vendor fix RHSA-2026:47974
  • Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/hypershift-rhel9-operator 1784856942
    fixed: vendor fix RHSA-2026:48284
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-hypershift-rhel8 1787001690
    fixed: vendor fix RHSA-2026:56789
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-hypershift-rhel9 1787055132
    fixed: vendor fix RHSA-2026:56912
show 11 more
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-hypershift-rhel9 1785534428
    fixed: vendor fix RHSA-2026:50758
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-hypershift-rhel9 1784914869
    fixed: vendor fix RHSA-2026:47728
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-hypershift-rhel9 1784912882
    fixed: vendor fix RHSA-2026:48699
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-hypershift-rhel9 1784913720
    fixed: vendor fix RHSA-2026:48657
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-hypershift-rhel9 1785288843
    fixed: vendor fix RHSA-2026:48676
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-hypershift-rhel9 1785301941
    fixed: vendor fix RHSA-2026:48670
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-hypershift-rhel9 1785192936
    fixed: vendor fix RHSA-2026:48693
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/cluster-logging-rhel9-operator
    not affected: component not present
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/hypershift-cli-rhel9, multicluster-engine/hypershift-addon-rhel9-operator, multicluster-engine/cluster-curator-controller-rhel9, multicluster-engine/managedcluster-import-controller-rhel9 Red Hat multicluster engine for Kubernetes 2.1 multicluster-engine/hive-rhel9 1784896750, multicluster-engine/work-rhel9 1784301362, multicluster-engine/discovery-rhel9 1784915379, multicluster-engine/placement-rhel9 1783986002, multicluster-engine/console-mce-rhel9 1784312384, multicluster-engine/must-gather-rhel9 1784849867, +24 more Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine/hive-rhel9 1784896768, multicluster-engine/work-rhel9 1784314624, multicluster-engine/discovery-rhel9 1784904558, multicluster-engine/placement-rhel9 1783986737, multicluster-engine/console-mce-rhel9 1784556108, multicluster-engine/must-gather-rhel9 1783985963, +20 more Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hive-rhel9 1784896748, multicluster-engine/work-rhel9 1784136764, multicluster-engine/discovery-rhel9 1784306906, multicluster-engine/placement-rhel9 1784332158, multicluster-engine/console-mce-rhel9 1785078604, multicluster-engine/must-gather-rhel9 1784590739, +20 more Red Hat multicluster engine for Kubernetes 2.9 multicluster-engine/hive-rhel9 1783362090, multicluster-engine/work-rhel9 1784677242, multicluster-engine/discovery-rhel9 1783260894, multicluster-engine/placement-rhel9 1784245366, multicluster-engine/console-mce-rhel9 1783348181, multicluster-engine/must-gather-rhel9 1783005291, +23 more Red Hat multicluster engine for Kubernetes 2.11 multicluster-engine/hive-rhel9 1780918072, multicluster-engine/work-rhel9 1780917940, multicluster-engine/discovery-rhel9 1780586101, multicluster-engine/placement-rhel9 1780918183, multicluster-engine/console-mce-rhel9 1781128292, multicluster-engine/must-gather-rhel9 1781232353, +25 more
    +1 more products
    Red Hat multicluster engine for Kubernetes 2.17 multicluster-engine/hive-rhel9 1780918859, multicluster-engine/work-rhel9 1780711470, multicluster-engine/maestro-rhel9 1781307519, multicluster-engine/discovery-rhel9 1780918592, multicluster-engine/placement-rhel9 1780911300, multicluster-engine/console-mce-rhel9 1780949268, +28 more
    not affected: vulnerable code not present
  • Red Hat OpenShift API for Data Protection oadp/oadp-rhel9-operator, oadp/oadp-hypershift-velero-plugin-rhel9
    not affected: component not present
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-must-gather-rhel9, rhacm2/rbac-query-proxy-rhel9, rhacm2/metrics-collector-rhel9, rhacm2/grafana-dashboard-loader-rhel9, rhacm2/endpoint-monitoring-rhel9-operator, rhacm2/multicluster-observability-rhel9-operator, +1 more Red Hat OpenShift Container Platform 4 openshift4/ose-cluster-network-operator, openshift4/ose-smb-csi-driver-rhel9-operator, openshift4/ose-cluster-network-rhel9-operator, openshift4/ose-cluster-storage-rhel9-operator, openshift4/ose-csi-driver-manila-rhel9-operator, openshift4/ose-aws-ebs-csi-driver-rhel9-operator, +7 more Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1787001024, openshift4/ose-pod 1787000960, openshift4/ose-tests 1787003927, openshift4/ose-console 1787056403, openshift4/ose-coredns 1787002405, openshift4/ose-deployer 1787002762, +191 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1787028201, openshift4/ose-tests 1787031287, openshift4/ose-console 1787028559, openshift4/ose-deployer 1787030550, openshift4/ose-installer 1787037007, openshift4/ose-pod-rhel9 1787056429, +186 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1785530229, openshift4/ose-pod-rhel9 1785542889, openshift4/ose-sdn-rhel9 1785542496, openshift4/ose-etcd-rhel9 1785582736, openshift4/ose-tools-rhel9 1785540957, openshift4/ose-ironic-rhel9 1785528575, +183 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1784323435, openshift4/ose-cli-rhel9 1784327350, openshift4/ose-pod-rhel9 1784317566, openshift4/ose-etcd-rhel9 1784313998, openshift4/ose-tests-rhel9 1784717215, openshift4/ose-tools-rhel9 1784715500, +182 more
    +5 more products
    Red Hat OpenShift Container Platform 4.18 openshift4/ose-ironic-rhel9 1785185273, openshift4/ose-console-rhel9 1785278569, openshift4/driver-toolkit-rhel9 1785360224, openshift4/ose-prometheus-rhel9 1785360067, openshift4/ose-oauth-proxy-rhel9 1785247738, openshift4/ose-monitoring-plugin-rhel9 1784718799, +4 more Red Hat OpenShift Container Platform 4.19 openshift4/ose-ironic-rhel9 1785176609, openshift4/ose-console-rhel9 1784800726, openshift4/network-tools-rhel9 1785209335, openshift4/ose-hyperkube-rhel9 1785344129, openshift4/driver-toolkit-rhel9 1785335610, openshift4/ose-prometheus-rhel9 1785343860, +11 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1785288599, openshift4/ose-cli-rhel9 1785302474, openshift4/ose-pod-rhel9 1785288563, openshift4/ose-etcd-rhel9 1785290355, openshift4/ose-tests-rhel9 1785291368, openshift4/ose-tools-rhel9 1785289200, +184 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1785298974, openshift4/ose-cli-rhel9 1785299006, openshift4/ose-pod-rhel9 1785298302, openshift4/ose-etcd-rhel9 1785301213, openshift4/ose-tests-rhel9 1785303852, openshift4/ose-tools-rhel9 1785298881, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1785191780, openshift4/ose-cli-rhel9 1785190983, openshift4/ose-pod-rhel9 1785192534, openshift4/ose-etcd-rhel9 1785190904, openshift4/ose-tests-rhel9 1785238838, openshift4/ose-tools-rhel9 1785237098, +181 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected products

  • Red Hat multicluster engine for Kubernetes 2.1
  • Red Hat multicluster engine for Kubernetes 2.11
  • Red Hat multicluster engine for Kubernetes 2.17
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat multicluster engine for Kubernetes 2.9
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat OpenShift API for Data Protection
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.