{"id":"CVE-2026-125637","kind":"vulnerability","aliases":["CVE-2026-125637"],"related":[],"title":"Konflux UI proxy: unvalidated hostnames in KonfluxUI resource let users inject proxy config and bypass authentication","description":"A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. In addition, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting.","summary":"Hostname values in the KonfluxUI custom resource are written into proxy configuration files without validation. A user who can edit that resource can inject directives that bypass authentication and reach internal backend services, and malformed input can stop the proxy from starting.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","konflux","kubernetes","operator","self-hosted"],"not_affected_if":["no-konflux-install","restricted-crd-edit-rights"],"how_to_check":"- Run `kubectl get konfluxui` (and `kubectl get konflux`) to see whether the Konflux operator is installed.\n- Run `kubectl auth can-i update konfluxuis.konflux.konflux-ci.dev --as <user>` or review RBAC and GitOps manifests: who can edit KonfluxUI or Konflux CRs?\n- Review the proxy hostname fields (tektonResults, kite, kubearchive, watson) in your KonfluxUI spec for anything that is not a plain DNS name.\n- Affected version range: unknown. An aggregator lists konflux-ci <=0.2.2, but no primary source confirms it.","fix":"No released fix found. Upstream PR konflux-ci/konflux-ci#10002 adds hostname validation (CRD pattern, reconciler check, hardened generate-proxy-config.sh); a follow-up PR #10033 also exists. Until a patched operator ships, limit edit rights on Konflux and KonfluxUI resources to cluster admins.","status":"open","published_at":"2026-11-11T23:17:10+00:00","first_seen_at":"2026-11-11T23:29:35+00:00","triaged_at":"2026-11-11T23:31:19+00:00","updated_at":"2026-11-11T23:32:31+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T23:31:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Konflux UI proxy: unvalidated hostnames let authenticated users bypass access controls","impact":"high","summary":"Hostname values in the KonfluxUI custom resource are written into proxy configuration files without validation. A user who can edit that resource can inject directives that bypass authentication and reach internal backend services, and malformed input can stop the proxy from starting.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["konflux","kubernetes"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user bypasses auth and reaches internal backend services","analyst_note":"Confirm affected Konflux versions and fixed release from the upstream advisory; NVD entry alone gives no fix or ranges.","how_to_check":"- Check whether the cluster runs Konflux and the KonfluxUI custom resource is installed, for example `kubectl get konfluxui`\n- Review who holds edit permissions on KonfluxUI resources\n- Versions affected: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-konflux-install","restricted-crd-edit-rights"],"who_is_affected":"Teams that run Konflux with the KonfluxUI custom resource. The risk depends on users who can modify that resource, so the exposure is limited to clusters where many people hold that permission. unknown for the exact affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000733,"input_tokens":4600,"output_tokens":546,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Konflux versions and fixed release from the upstream advisory; NVD entry alone gives no fix or ranges.","search":"'-125637':19A,22A '-2026':18A,21A 'addit':128C 'adequ':97C 'authent':16A,57B,102C,118C 'author':120C 'backend':61B,125C 'bypass':15A,56B,117C 'caus':133C 'config':13A 'configur':41B,94C,114C,135C 'control':121C 'custom':35B,87C,109C 'cve':17A,20A 'defin':83C 'denial':142C 'direct':54B,91C,115C 'dos':145C 'edit':49B 'expos':123C 'fail':138C 'file':42B,95C 'flaw':73C 'found':75C 'generat':136C 'host':29B 'hostnam':5A,30B,81C 'infrastructur':23B 'inject':11A,53B,112C 'input':65B,131C 'insert':90C 'intern':60B,124C 'konflux':1A,24B,78C 'konfluxui':7A,34B,86C 'kubernet':25B 'let':9A 'malform':64B,130C 'malici':113C 'modifi':107C 'oper':26B 'permiss':105C 'potenti':122C 'prevent':147C 'provid':129C 'proxi':3A,12A,40B,69B,80C,93C,149C 'reach':59B 'resourc':8A,36B,51B,88C,110C 'result':139C 'sanit':100C 'self':28B 'self-host':27B 'servic':62B,126C,144C 'start':71B,151C 'stop':67B 'ui':2A,79C 'unvalid':4A 'user':10A,46B,103C 'valid':44B,98C 'valu':31B,82C 'without':43B,96C 'written':38B","nicknames":[],"mitigations":[],"who_affected":"Clusters that run the Konflux operator where more than cluster admins can edit the KonfluxUI (or Konflux) custom resource, or where GitOps manifests for it are writable by others. Red Hat rates it Important and says triggering needs administrative-level rights to the CR. Exploiting it puts an unauthenticated route ahead of the proxy's auth chain, exposing internal backends and the Kubernetes API. Skip if you don't run Konflux or if only cluster admins can edit these resources.","tier":"B","verified":{"workarounds":{"at":"2026-11-11T23:32:31Z","by":"analyst","doc":"https://github.com/konflux-ci/konflux-ci/pull/10002","run_id":3671}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","konflux","kubernetes","operator","selfhosted"],"campaign_type":null,"search_a":"'-125637':19A,22A '-2026':18A,21A 'authent':16A 'bypass':15A 'config':13A 'cve':17A,20A 'hostnam':5A 'inject':11A 'konflux':1A 'konfluxui':7A 'let':9A 'proxi':3A,12A 'resourc':8A 'ui':2A 'unvalid':4A 'user':10A","search_b":"'authent':57B 'backend':61B 'bypass':56B 'configur':41B 'custom':35B 'direct':54B 'edit':49B 'file':42B 'host':29B 'hostnam':30B 'infrastructur':23B 'inject':53B 'input':65B 'intern':60B 'konflux':24B 'konfluxui':34B 'kubernet':25B 'malform':64B 'oper':26B 'proxi':40B,69B 'reach':59B 'resourc':36B,51B 'self':28B 'self-host':27B 'servic':62B 'start':71B 'stop':67B 'user':46B 'valid':44B 'valu':31B 'without':43B 'written':38B","search_c":"'addit':128C 'adequ':97C 'authent':102C,118C 'author':120C 'backend':125C 'bypass':117C 'caus':133C 'configur':94C,114C,135C 'control':121C 'custom':87C,109C 'defin':83C 'denial':142C 'direct':91C,115C 'dos':145C 'expos':123C 'fail':138C 'file':95C 'flaw':73C 'found':75C 'generat':136C 'hostnam':81C 'inject':112C 'input':131C 'insert':90C 'intern':124C 'konflux':78C 'konfluxui':86C 'malform':130C 'malici':113C 'modifi':107C 'permiss':105C 'potenti':122C 'prevent':147C 'provid':129C 'proxi':80C,93C,149C 'resourc':88C,110C 'result':139C 'sanit':100C 'servic':126C,144C 'start':151C 'ui':79C 'user':103C 'valid':98C 'valu':82C 'without':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125637","severity":null,"published_at":"2026-11-11T23:17:10+00:00","modified_at":"2026-11-11T23:17:10+00:00","first_seen_at":"2026-11-11T23:29:35+00:00","fetched_at":"2026-11-11T23:29:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125637:3671","url":"https://access.redhat.com/security/cve/CVE-2026-125637","severity":null,"published_at":"2026-11-11T23:32:31+00:00","modified_at":"2026-11-11T23:32:31+00:00","first_seen_at":"2026-11-11T23:32:31+00:00","fetched_at":"2026-11-11T23:32:31+00:00","note":"Primary: Red Hat CVE page (no version range) and upstream PR #10002 (maintainer text: workaround = restrict CR edit to cluster admins; fix not yet consumed). Affected versions and release unknown; the PR was open at last read. Revisit when a release is tagged.","cites":["https://access.redhat.com/security/cve/CVE-2026-125637","https://github.com/konflux-ci/konflux-ci/pull/10002"]}],"documents":[{"id":130125,"url":"https://access.redhat.com/security/cve/CVE-2026-125637","title":"Red Hat CVE-2026-125637","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":130126,"url":"https://github.com/konflux-ci/konflux-ci/pull/10002","title":"fix: restrict UI proxy hostnames to DNS names (CVE-2026-125637)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}