---
id: "CVE-2026-117681"
kind: "vulnerability"
aliases: ["CVE-2026-117681"]
title: "konflux-ci: UI proxy skips TLS checks, letting network attacker steal cluster admin token"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "konflux-ci", "fixed": [], "affected": "unknown", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "konflux-ci", "kubernetes", "non-openshift", "openshift", "self-hosted"]
not_affected_if: ["default-service-ca-present", "no-adjacent-network-attacker", "openshift"]
published_at: "2026-10-31T09:16:33+00:00"
first_seen_at: "2026-10-31T09:34:41+00:00"
updated_at: "2026-10-31T09:36:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117681", "first_seen_at": "2026-10-31T09:34:41+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T09:36:58+00:00"}]
---

# konflux-ci: UI proxy skips TLS checks, letting network attacker steal cluster admin token

The konflux-ci user interface proxy disables TLS certificate verification when talking to internal backend services in clusters without a default service certificate authority. Because it attaches a cluster-scoped token with user impersonation rights to those requests, an adjacent network attacker who intercepts traffic can capture the token and gain full administrative control of the cluster.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:konflux-ci affected unknown fixed ?

## How to check

- Confirm you run konflux-ci on non-OpenShift Kubernetes (konflux-ui namespace, proxy deployment).
- Check whether the service CA bundle exists in the proxy pod (the generate-proxy-config script uses the file at SERVICE_CA_PATH); if absent, the generated Caddy config uses tls_insecure_skip_verify for backends.
- Assess whether an attacker could intercept pod-to-service traffic on your cluster network.

## Timeline

- 2026-10-31T09:34:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117681
- 2026-10-31T09:36:58+00:00 analyst — Read Red Hat CVE page: affects non-OpenShift Kubernetes installs of konflux-ci without service CA (OpenShift enforces TLS). No fixed version or affected range published by Red Hat/NVD; no konflux-ci GHSA found. No public PoC or exploitation found.

## Documents

- [advisory] Red Hat CVE-2026-117681 https://access.redhat.com/security/cve/CVE-2026-117681

## From the sources

A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_