A flaw was found in the Konnectivity proxy-server configuration for hosted control planes

Konnectivity is the tunnel Kubernetes uses when the API server needs to reach nodes that live on the other side of a network boundary — kubectl exec, kubectl logs, port-forward, admission webhook callbacks, metrics scraping. In hosted control planes (HyperShift, ROSA HCP, ARO HCP, Red Hat OpenShift managed offerings, and downstream vendors reusing the pattern), the proxy-server runs alongside kube-apiserver and exposes an agent-facing listener — the *cluster endpoint*, typically service konnectivity-server:8091 fronted by a Route/NodePort/LB so agents in the tenant data plane can dial home. The bug: that listener was started without --cluster-ca-cert and without a token-auth alternative, so any TCP peer that completes the TLS handshake is accepted as a legitimate agent and enrolled into the routing pool. Affected configurations are HyperShift-derived control planes shipping with the vulnerable manifest set; check whether the konnectivity-server container args include --cluster-ca-cert= or --agent-namespace/--agent-service-account token mode.

The vendor's CRITICAL / 9.4 is not inflation. AV:N/AC:L/PR:N/UI:N is accurate when the cluster endpoint is exposed via Route or LB (the default in most managed offerings). C:H/I:H is accurate because a rogue agent doesn't just eavesdrop — it becomes a load-balanced peer for real API-server→node traffic, which means it can *proxy, inspect, modify, or drop* exec streams, webhook responses, and log data across every tenant node whose traffic gets round-robined to it. The A:L is arguably light; a hostile agent that drops traffic can brown-out an entire hosted cluster. Baseline holds.

Why this verdict

• Missing authentication, not weak authentication. CWE-306 means the door isn't locked — no brute force, no cred harvest, no chain. TLS handshake completes and you are in the routing pool.
• Role multiplier — orchestration control plane. The affected component is the tunnel through which kube-apiserver reaches every worker. Chain outcome is fleet-scale traffic interception, not single-host compromise. This is canonically a high-value-role component (≥10% of installs occupy the high-value role by definition — 100% do, actually), so the CRITICAL floor holds.
• Cluster endpoint is designed to be externally reachable in managed HCP so tenant agents can NAT-traverse. Unlike most 'internal control-plane' bugs, exposure is not accidental — it is architectural.
• Weaponization is one go run away — the legitimate agent binary from kubernetes-sigs/apiserver-network-proxy is the exploit. No custom tooling required.
• Cross-tenant impact in multi-tenant HCP — a single vulnerable proxy-server instance sits in front of multiple hosted control planes' agent flows in some provider topologies, making this a *provider-scale* incident, not a customer-scale one.

Why not higher?

CVSS caps at 10.0 and the vendor's 9.4 already reflects the maximal AV:N/AC:L/PR:N/UI:N with C:H/I:H. Availability is realistically H not L (a malicious peer can blackhole entire clusters) so 9.5–9.8 would be defensible, but bucket is CRITICAL either way — no operational benefit to arguing decimals.

Why not lower?

Any downgrade would require evidence that the affected component is NOT canonically deployed in a control-plane role, or that the cluster endpoint is architecturally isolated from attacker networks. Neither holds for HyperShift-family deployments. 'Requires network reachability' is not a friction argument here — reachability is the intended design.

1. Restrict the Konnectivity cluster endpoint to known agent CIDRs immediately — Apply an NLB/Route ACL, security group, or NetworkPolicy limiting ingress to konnectivity-server:8091 (or the Route hostname) to the source CIDRs of your managed data-plane VPCs/subnets. This is the fastest way to buy time before the manifest patch lands. Deploy within 3 days per noisgate mitigation SLA.
2. Audit every hosted control plane for the missing --cluster-ca-cert arg — Run oc -n <hcp-ns> get pod -l app=kube-apiserver -o jsonpath='{.items[*].spec.containers[?(@.name=="konnectivity-server")].args}' across every control-plane namespace. Any instance without --cluster-ca-cert= AND without --agent-namespace/--agent-service-account is vulnerable. Enumerate today; remediate manifests within 3 days.
3. Rotate ServiceAccount tokens and kubelet client certs on any potentially-exposed hosted cluster — Assume interception has occurred on any endpoint that was internet-reachable prior to remediation. Cycle SA tokens (kubectl delete secret for legacy SA tokens; force projected-token refresh), rotate kubelet client-cert PKI, and invalidate long-lived bootstrap tokens. Complete within the 3-day mitigation window.
4. Enable audit logging of Konnectivity backend connection events — Turn on verbose logging for konnectivity_network_proxy_server_ready_backend_connections metric changes and ship connection-accepted events (with peer identity — expected to be non-empty post-patch) to your SIEM. Alert on any anonymous/empty-identity agent connect.
5. Deploy vendor-patched HyperShift operator to enforce correct manifest generation — The operator regenerates control-plane pod specs. Track the fixed HyperShift/OCP HCP release and roll it out cluster-by-cluster. Complete full remediation within 90 days per noisgate remediation SLA.

Run this on a workstation with oc (or kubectl) auth to the management cluster hosting the HyperShift control planes. Requires read access to all hosted-control-plane namespaces (typically cluster-admin on the management cluster). Invoke: ./check-cve-2026-16242.sh — it will iterate every HCP namespace and print VULNERABLE, PATCHED, or UNKNOWN per control plane, and exit non-zero if any vulnerable instance is found.

#!/usr/bin/env bash
# check-cve-2026-16242.sh
# Detects Konnectivity proxy-server started without --cluster-ca-cert
# and without token-based agent auth in HyperShift/OCP HCP deployments.
# Exit codes: 0 = all PATCHED, 1 = at least one VULNERABLE, 2 = UNKNOWN state

set -u
CLI=${CLI:-oc}
command -v "$CLI" >/dev/null 2>&1 || CLI=kubectl
command -v "$CLI" >/dev/null 2>&1 || { echo "UNKNOWN: no oc/kubectl in PATH"; exit 2; }

vuln=0
unknown=0
checked=0

# Find every namespace that looks like a hosted control plane
namespaces=$($CLI get ns -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}' \
  | grep -E '^(clusters-|ocm-|hcp-)' || true)

if [ -z "$namespaces" ]; then
  # Fallback: any ns with a konnectivity-server container
  namespaces=$($CLI get pods -A -o jsonpath='{range .items[?(@.spec.containers[*].name=="konnectivity-server")]}{.metadata.namespace}{"\n"}{end}' | sort -u)
fi

for ns in $namespaces; do
  pods=$($CLI -n "$ns" get pods -l app=kube-apiserver -o name 2>/dev/null)
  [ -z "$pods" ] && continue
  for pod in $pods; do
    checked=$((checked+1))
    args=$($CLI -n "$ns" get "$pod" \
      -o jsonpath='{.spec.containers[?(@.name=="konnectivity-server")].args}' 2>/dev/null)
    if [ -z "$args" ]; then
      echo "UNKNOWN: $ns/$pod (no konnectivity-server container found)"
      unknown=$((unknown+1))
      continue
    fi
    has_ca=$(echo "$args" | grep -c -- '--cluster-ca-cert=' || true)
    has_token=$(echo "$args" | grep -cE -- '--agent-namespace=|--agent-service-account=' || true)
    if [ "$has_ca" -ge 1 ] || [ "$has_token" -ge 1 ]; then
      echo "PATCHED:    $ns/$pod"
    else
      echo "VULNERABLE: $ns/$pod (no --cluster-ca-cert, no token auth)"
      vuln=$((vuln+1))
    fi
  done
done

echo "---"
echo "Checked: $checked  Vulnerable: $vuln  Unknown: $unknown"

if [ "$vuln" -gt 0 ]; then exit 1; fi
if [ "$checked" -eq 0 ] || [ "$unknown" -gt 0 ]; then exit 2; fi
exit 0

Sources

1. Red Hat Security — CVE tracker (parent path)
2. HyperShift docs — Konnectivity architecture
3. Kubernetes upstream — Set up Konnectivity service
4. kubernetes-sigs/apiserver-network-proxy (upstream)
5. OpenShift 4.18 Networking for Hosted Control Planes
6. OpenShift 4.19 Hosted Control Planes (single-page)
7. OpenShift 4.17 Hosted Control Planes release notes
8. CWE-306: Missing Authentication for Critical Function