# CVE-2026-125637: Konflux UI proxy configuration injection in KonfluxUI custom resource

Source: https://junglewise.ai/threats/cve-2026-125637-a-flaw-was-found-in-the-konflux-ui-proxy-hostname-values-defined  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-125637 · Severity: high · CVSS 7.2 · Published 2026-11-11

Konflux is a cloud-native software factory used to build and release trusted software artifacts. An authenticated administrator who can modify the KonfluxUI custom resource can inject malicious proxy configuration directives that bypass authentication controls, potentially exposing internal backend services and the Kubernetes API to unauthenticated access. Additionally, malformed input can crash the configuration generator, preventing the proxy from starting.

Vendors: [Konflux CI](https://junglewise.ai/threats/vendors/konflux-ci).

## Quick answers

**Is CVE-2026-125637 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-125637 being exploited in the wild.

**How severe is CVE-2026-125637?** High severity, with a CVSS score of 7.2, published 11 November 2026.

**Which products and versions are affected?** Konflux CI Konflux UI proxy.

**Is there a fix for CVE-2026-125637?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-125637 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-125637?** Check whether you run Konflux CI Konflux UI proxy. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a code injection flaw (CWE-94) in the Konflux UI proxy generator where hostname values from the KonfluxUI custom resource are inserted into Caddyfile proxy configuration files without validation or sanitization. An authenticated user with permissions to modify the custom resource can inject malicious Caddyfile directives to bypass the forward_auth and impersonate authorization chain, or provide malformed input to trigger a denial of service condition. The vulnerability requires administrative privileges but completely circumvents the proxy's authentication enforcement.

## Affected products

- Konflux CI Konflux UI proxy

## Timeline

- 2026-11-11: disclosed: CVE published

## References

- [https://github.com/konflux-ci/konflux-ci](https://github.com/konflux-ci/konflux-ci)
- [https://access.redhat.com/security/cve/CVE-2026-125637](https://access.redhat.com/security/cve/CVE-2026-125637)