Is CVE-2026-117681 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-117681 being exploited in the wild.

How severe is CVE-2026-117681?

High severity, with a CVSS score of 8, published 31 October 2026.

Is there a fix for CVE-2026-117681?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-117681 attacked?

It is attacked from the adjacent network or over the network, in a hosted service.

Am I affected by CVE-2026-117681?

Check whether you run Konflux CI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-117681: Konflux-ci privilege escalation via TLS certificate verification bypass

CVE-2026-117681 · Severity: high · CVSS 8 · Published 2026-10-31

Konflux-ci is a cloud-native software factory platform for building and releasing trusted software artifacts. A security flaw allows an attacker on the same network to intercept unencrypted traffic between the user interface proxy and backend services, stealing authentication credentials that grant full administrative control of the Kubernetes cluster. This impacts non-OpenShift Kubernetes deployments that lack a default service certificate authority.

Technologies: Konflux CI. Vendors: Konflux CI.

Quick answers

Is CVE-2026-117681 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-117681 being exploited in the wild.
How severe is CVE-2026-117681?: High severity, with a CVSS score of 8, published 31 October 2026.
Which products and versions are affected?: Konflux CI <UNKNOWN>.
Is there a fix for CVE-2026-117681?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-117681 attacked?: It is attacked from the adjacent network or over the network, in a hosted service.
Am I affected by CVE-2026-117681?: Check whether you run Konflux CI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is improper certificate validation (CWE-295) in the UI proxy component, which automatically disables TLS verification for internal backend connections when a service CA is unavailable. An adjacent network attacker can intercept traffic and capture cluster-scoped bearer tokens with user impersonation rights, enabling full cluster compromise. The flaw is specific to non-OpenShift Kubernetes environments; standard Red Hat OpenShift deployments are protected by the platform's service CA.

Affected products

Konflux-ci Konflux-ci <UNKNOWN>

Timeline

2026-10-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.