{"id":"CVE-2026-117681","kind":"vulnerability","aliases":["CVE-2026-117681"],"related":[],"title":"konflux-ci: UI proxy skips TLS checks, letting network attacker steal cluster admin token","description":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.","summary":"The konflux-ci user interface proxy disables TLS certificate verification when talking to internal backend services in clusters without a default service certificate authority. Because it attaches a cluster-scoped token with user impersonation rights to those requests, an adjacent network attacker who intercepts traffic can capture the token and gain full administrative control of the cluster.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"konflux-ci","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","konflux-ci","kubernetes","non-openshift","openshift","self-hosted"],"not_affected_if":["default-service-ca-present","no-adjacent-network-attacker","openshift"],"how_to_check":"- Confirm you run konflux-ci on non-OpenShift Kubernetes (konflux-ui namespace, proxy deployment).\n- Check whether the service CA bundle exists in the proxy pod (the generate-proxy-config script uses the file at SERVICE_CA_PATH); if absent, the generated Caddy config uses tls_insecure_skip_verify for backends.\n- Assess whether an attacker could intercept pod-to-service traffic on your cluster network.","fix":null,"status":"open","published_at":"2026-10-31T09:16:33+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","triaged_at":"2026-10-31T09:35:43+00:00","updated_at":"2026-10-31T09:36:58+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-31T09:35:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"konflux-ci: UI proxy skips TLS checks, letting network attacker steal cluster admin token","impact":"high","summary":"The konflux-ci user interface proxy disables TLS certificate verification when talking to internal backend services in clusters without a default service certificate authority. Because it attaches a cluster-scoped token with user impersonation rights to those requests, an adjacent network attacker who intercepts traffic can capture the token and gain full administrative control of the cluster.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["konflux-ci","kubernetes","openshift"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker takes full administrative control of the cluster via stolen token","analyst_note":"Sources give no affected version range or fix; check the NVD entry and the konflux-ci project for the patched release.","how_to_check":"- Check whether the konflux-ci UI proxy is deployed in your cluster and which version it runs.\n- Check whether the cluster lacks a default service certificate authority, which the description names as the trigger condition.\n- Check whether an adjacent network attacker could intercept traffic between the proxy and internal backend services.","plain_action":"","needs_analyst":true,"not_affected_if":["default-service-ca-present","no-adjacent-network-attacker"],"who_is_affected":"Teams running konflux-ci on Kubernetes or OpenShift clusters where the UI proxy talks to internal backend services without a default service certificate authority. The description says the exposure requires an adjacent attacker able to intercept traffic on the network. Clusters with a default service CA, or where the proxy verifies certificates, are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4157,"output_tokens":641,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no affected version range or fix; check the NVD entry and the konflux-ci project for the patched release.","search":"'-117681':18A,21A '-2026':17A,20A 'adjac':78B,154C 'admin':14A 'administr':91B,168C 'allow':106C 'attach':64B,139C 'attack':11A,80B,156C 'authent':144C 'author':61B,135C 'automat':114C 'backend':52B,126C 'capabl':157C 'captur':85B,162C 'certif':46B,60B,120C,134C 'check':8A 'ci':3A,24A,28B,40B,103C 'cluster':13A,55B,67B,95B,142C,172C 'cluster-scop':66B,141C 'connect':123C 'control':92B,169C 'credenti':164C 'cve':16A,19A 'default':58B,132C 'disabl':44B,115C 'environ':129C 'escal':108C 'flaw':97C 'found':99C 'full':90B,167C 'gain':89B,166C 'host':36B 'imperson':72B,148C 'infrastructur':25B 'intercept':82B,159C 'interfac':42B,112C 'intern':51B,125C 'konflux':2A,23A,27B,39B,102C 'konflux-ci':1A,22A,26B,38B,101C 'kubernet':29B 'lack':130C 'layer':117C 'let':9A 'network':10A,79B,155C 'non':31B 'non-openshift':30B 'openshift':32B,33B 'privileg':107C 'proxi':5A,43B,113C,138C 'request':76B,152C 'right':73B,149C 'scope':68B,143C 'secur':118C 'self':35B 'self-host':34B 'servic':53B,59B,127C,133C 'skip':6A 'steal':12A 'talk':49B 'tls':7A,45B,119C 'token':15A,69B,87B,145C 'traffic':83B,160C 'transport':116C 'ui':4A 'user':41B,71B,111C,147C 'verif':47B,121C 'vulner':105C 'without':56B","nicknames":[],"mitigations":[],"who_affected":"Teams running konflux-ci on plain (non-OpenShift) Kubernetes, where no service certificate authority is present and the UI proxy falls back to unverified TLS toward internal backends. The proxy sends a cluster-scoped token that can impersonate any user or group, so an attacker on the same network who can intercept that traffic can take over the cluster. Standard OpenShift installs get a service CA and keep verification on, so they can skip this.","tier":"B","verified":{"who_affected":{"at":"2026-10-31T09:36:58Z","by":"analyst","doc":"https://access.redhat.com/security/cve/CVE-2026-117681","run_id":1233}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T09:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117681","severity":null,"published_at":"2026-10-31T09:16:33+00:00","modified_at":"2026-10-31T09:16:33+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","fetched_at":"2026-10-31T09:34:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117681:1233","url":null,"severity":null,"published_at":"2026-10-31T09:36:58+00:00","modified_at":"2026-10-31T09:36:58+00:00","first_seen_at":"2026-10-31T09:36:58+00:00","fetched_at":"2026-10-31T09:36:58+00:00","note":"Read Red Hat CVE page: affects non-OpenShift Kubernetes installs of konflux-ci without service CA (OpenShift enforces TLS). No fixed version or affected range published by Red Hat/NVD; no konflux-ci GHSA found. No public PoC or exploitation found."}],"documents":[{"id":31098,"url":"https://access.redhat.com/security/cve/CVE-2026-117681","title":"Red Hat CVE-2026-117681","kind":"advisory","source":"analyst","publisher":null,"text":"Red Hat: Important. In standard OpenShift the service CA gives the proxy trusted certs so TLS verification stays enforced. Insecure fallback affects non-OpenShift Kubernetes clusters where the service CA is absent. No mitigation available. Bugzilla 2563233. CWE-295. Credit: Aditya Amol Kuchekar.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}