CVE-2026-16242criticalCWE-306

CVE-2026-16242: falha crítica em Red Hat Logging Subsystem for Red Hat OpenShift

Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat OpenShift Container Platform+ Monitorar Red Hat Advanced Cluster Management for Kubernetes

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.4epss 0.9%
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Produtos afetados
Red Hat · Logging Subsystem for Red Hat OpenShiftRed Hat · Multicluster Engine for KubernetesRed Hat · multicluster engine for Kubernetes 2.1Red Hat · multicluster engine for Kubernetes 2.11Red Hat · multicluster engine for Kubernetes 2.17Red Hat · multicluster engine for Kubernetes 2.6Red Hat · multicluster engine for Kubernetes 2.8Red Hat · multicluster engine for Kubernetes 2.9Red Hat · OpenShift API for Data ProtectionRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 4.14Red Hat · Red Hat OpenShift Container Platform 4.15Red Hat · Red Hat OpenShift Container Platform 4.16Red Hat · Red Hat OpenShift Container Platform 4.17Red Hat · Red Hat OpenShift Container Platform 4.18Red Hat · Red Hat OpenShift Container Platform 4.19Red Hat · Red Hat OpenShift Container Platform 4.20Red Hat · Red Hat OpenShift Container Platform 4.21Red Hat · Red Hat OpenShift Container Platform 4.22
CVEs relacionadas — Red Hat Logging Subsystem for Red Hat OpenShift

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3727HIGHContainers/image: digest type does not guarantee valid typeEPSS 1.3%CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2024-5037HIGHOpenshift/telemeter: iss check during jwt authentication can be bypassedEPSS 0.8%CVE-2024-0874MEDIUMCoredns: cd bit response is cached and served laterEPSS 0.8%CVE-2024-12401MEDIUMCert-manager: potential dos when parsing specially crafted pem inputsEPSS 0.7%CVE-2026-10059CRITICALCluster-curator-controller: cluster-curator-controller: namespace admin can escalate to cluster-wide curator authority via clustercurator serviceaccount tokenEPSS 0.6%