CVE-2026-125637 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Hostname values in the KonfluxUI custom resource are written into proxy configuration files without validation. A user who can edit that resource can inject directives that bypass authentication and reach internal backend services, and malformed input can stop the proxy from starting.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Clusters that run the Konflux operator where more than cluster admins can edit the KonfluxUI (or Konflux) custom resource, or where GitOps manifests for it are writable by others. Red Hat rates it Important and says triggering needs administrative-level rights to the CR. Exploiting it puts an unauthenticated route ahead of the proxy's auth chain, exposing internal backends and the Kubernetes API. Skip if you don't run Konflux or if only cluster admins can edit these resources.
Not affected if no-konflux-install, restricted-crd-edit-rights
Who cares konflux, kubernetes, operator, self-hosted
kubectl get konfluxui (and kubectl get konflux) to see whether the Konflux operator is installed.kubectl auth can-i update konfluxuis.konflux.konflux-ci.dev --as <user> or review RBAC and GitOps manifests: who can edit KonfluxUI or Konflux CRs?A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. In addition, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.