Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates

Summary

A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.

Timeline

1. Jul 20, 2026, 7:33 AM UTCCVE published
2. Jul 21, 2026, 2:56 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Sep 14, 2026, 2:46 PM UTCRecord last updated

Affected versions

• multicluster-engine/hypershift-rhel9-operator

  Version range not reported

• multicluster-engine/hypershift-rhel9-operator

  Version range not reported

• multicluster-engine/hypershift-rhel9-operator

  Version range not reported

• multicluster-engine/hypershift-rhel9-operator

  Version range not reported

• multicluster-engine/hypershift-rhel9-operator

  Version range not reported

• multicluster-engine/hypershift-rhel9-operator

  Version range not reported

• multicluster-engine/hypershift-rhel9-operator

  Version range not reported

• openshift4/ose-hypershift-rhel8

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift4/ose-hypershift-rhel9

  Version range not reported

• openshift-logging/cluster-logging-rhel9-operator

  Version range not reported

• multicluster-engine/cluster-curator-controller-rhel9

  Version range not reported

• multicluster-engine/hypershift-addon-rhel9-operator

  Version range not reported

• multicluster-engine/hypershift-cli-rhel9

  Version range not reported

• multicluster-engine/managedcluster-import-controller-rhel9

  Version range not reported

• oadp/oadp-hypershift-velero-plugin-rhel9

  Version range not reported

• oadp/oadp-rhel9-operator

  Version range not reported

• rhacm2/acm-multicluster-observability-addon-rhel9

  Version range not reported

• rhacm2/acm-must-gather-rhel9

  Version range not reported

• rhacm2/endpoint-monitoring-rhel9-operator

  Version range not reported

• rhacm2/grafana-dashboard-loader-rhel9

  Version range not reported

• rhacm2/metrics-collector-rhel9

  Version range not reported

• rhacm2/multicluster-observability-rhel9-operator

  Version range not reported

• rhacm2/rbac-query-proxy-rhel9

  Version range not reported

• openshift4/ose-aws-ebs-csi-driver-rhel9-operator

  Version range not reported

• openshift4/ose-aws-efs-csi-driver-rhel9-operator

  Version range not reported

• openshift4/ose-azure-disk-csi-driver-rhel9-operator

  Version range not reported

• openshift4/ose-azure-file-csi-driver-operator-rhel9

  Version range not reported

• openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator

  Version range not reported

• openshift4/ose-cluster-network-operator

  Version range not reported

• openshift4/ose-cluster-network-rhel9-operator

  Version range not reported

• openshift4/ose-cluster-node-tuning-rhel9-operator

  Version range not reported

• openshift4/ose-cluster-storage-rhel9-operator

  Version range not reported

• openshift4/ose-csi-driver-manila-rhel9-operator

  Version range not reported

• openshift4/ose-openstack-cinder-csi-driver-rhel9-operator

  Version range not reported

• openshift4/ose-powervs-block-csi-driver-rhel9-operator

  Version range not reported

• openshift4/ose-smb-csi-driver-rhel9-operator

  Version range not reported

References 19