Live › vulnerability › CVE-2026-117681
The konflux-ci user interface proxy disables TLS certificate verification when talking to internal backend services in clusters without a default service certificate authority. Because it attaches a cluster-scoped token with user impersonation rights to those requests, an adjacent network attacker who intercepts traffic can capture the token and gain full administrative control of the cluster.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 09:34 UTC. All times on this page are UTC.
Teams running konflux-ci on plain (non-OpenShift) Kubernetes, where no service certificate authority is present and the UI proxy falls back to unverified TLS toward internal backends. The proxy sends a cluster-scoped token that can impersonate any user or group, so an attacker on the same network who can intercept that traffic can take over the cluster. Standard OpenShift installs get a service CA and keep verification on, so they can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| konflux-ci | vendor | unknown | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.
This page as .md · .json · in your agent: get_signal("CVE-2026-117681")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.