CVE-2026-16242
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Vulnerability in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert, so client certificates were not validated. A remote attacker can connect as an unauthenticated agent and intercept control-plane-to-node traffic.
Risk Assessment
Risk is high – an attacker can eavesdrop, modify, or drop critical Kubernetes cluster traffic.
Recommendation
Configure Konnectivity proxy with proper CA certificate and enable token-based agent authentication.
Original NVD description (English source)
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.