---
id: "CVE-2026-125637"
page: "https://infrastack.ai/live/CVE-2026-125637"
kind: "vulnerability"
aliases: ["CVE-2026-125637"]
title: "Konflux UI proxy: unvalidated hostnames in KonfluxUI resource let users inject proxy config and bypass authentication"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "konflux", "kubernetes", "operator", "self-hosted"]
not_affected_if: ["no-konflux-install", "restricted-crd-edit-rights"]
published_at: "2026-11-11T23:17:10+00:00"
first_seen_at: "2026-11-11T23:29:35+00:00"
updated_at: "2026-11-11T23:32:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125637", "first_seen_at": "2026-11-11T23:29:35+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-125637", "first_seen_at": "2026-11-11T23:32:31+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-125637", "https://github.com/konflux-ci/konflux-ci/pull/10002"]}]
exploit_sources: []
---

# Konflux UI proxy: unvalidated hostnames in KonfluxUI resource let users inject proxy config and bypass authentication

Link for people: https://infrastack.ai/live/CVE-2026-125637 (this .md is for agents)

Hostname values in the KonfluxUI custom resource are written into proxy configuration files without validation. A user who can edit that resource can inject directives that bypass authentication and reach internal backend services, and malformed input can stop the proxy from starting.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `kubectl get konfluxui` (and `kubectl get konflux`) to see whether the Konflux operator is installed.
- Run `kubectl auth can-i update konfluxuis.konflux.konflux-ci.dev --as <user>` or review RBAC and GitOps manifests: who can edit KonfluxUI or Konflux CRs?
- Review the proxy hostname fields (tektonResults, kite, kubearchive, watson) in your KonfluxUI spec for anything that is not a plain DNS name.
- Affected version range: unknown. An aggregator lists konflux-ci <=0.2.2, but no primary source confirms it.

## Fix

No released fix found. Upstream PR konflux-ci/konflux-ci#10002 adds hostname validation (CRD pattern, reconciler check, hardened generate-proxy-config.sh); a follow-up PR #10033 also exists. Until a patched operator ships, limit edit rights on Konflux and KonfluxUI resources to cluster admins.

## Timeline

- 2026-11-11T23:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125637
- 2026-11-11T23:32:31+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-125637 — Primary: Red Hat CVE page (no version range) and upstream PR #10002 (maintainer text: workaround = restrict CR edit to cluster admins; fix not yet consumed). Affected versions and release unknown; the PR was open at last read. Revisit when a release is tagged.

## Documents

- [advisory] Red Hat CVE-2026-125637 https://access.redhat.com/security/cve/CVE-2026-125637
- [fix] fix: restrict UI proxy hostnames to DNS names (CVE-2026-125637) https://github.com/konflux-ci/konflux-ci/pull/10002

## From the sources

A flaw was found in the Konflux UI proxy. Hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. In addition, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_