Executive brief
A security flaw was found in the Konnectivity proxy-server, a component used in hosted Kubernetes control planes to manage communication between the control center and worker nodes. Due to a configuration error, the server fails to verify the identity of connecting agents, allowing an unauthorized person to join the internal communication network. An attacker could use this access to intercept, modify, or block sensitive data moving between the system's management layer and its worker nodes, potentially compromising the entire cluster.
Technical details
A vulnerability exists in the Konnectivity proxy-server configuration within HyperShift's hosted control planes. The agent-facing TLS listener is initialized without the '--cluster-ca-cert' flag and lacks token-based authentication, causing it to default to a state where client certificates are not requested or validated (tls.NoClientCert). A remote attacker with network reachability to the Konnectivity cluster endpoint can connect as an unauthenticated agent and join the routing pool. Once connected, the attacker can proxy, inspect, modify, or drop traffic routed through their connection, including sensitive data such as 'kubectl exec' streams, pod specifications containing secrets, and service account tokens.
Affected products
- Red Hat HyperShift
- Red Hat OpenShift Container Platform
- Red Hat Multicluster Engine for Kubernetes
Timeline
- 2026-07-17: patched: Pull request to fix authentication submitted to HyperShift repository
- 2026-07-20: disclosed: CVE published by Red Hat