Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates
Priority MEDIUM 50CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-306.
Summary
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00918 60th percentileScored 2026-11-07
Fix Fixed Red Hat: 16 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | multicluster engine for Kubernetes 2.1 | — | 1784905766 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.1 | — | 1784905766 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.11 | — | 1784945966 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.17 | — | 1784856942 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.6 | — | 1784905804 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.8 | — | 1784905783 | Patch available | CNA |
| Red Hat | multicluster engine for Kubernetes 2.9 | — | 1784905769 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1787001690 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1787055132 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | 1785534428 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | 1784914869 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | 1784912882 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | 1784913720 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | 1785288843 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | 1785301941 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | 1785192936 | Patch available | CNA |
| Red Hat | Logging Subsystem for Red Hat OpenShift | — | — | Not affected | CNA |
| Red Hat | Multicluster Engine for Kubernetes | — | — | Not affected | CNA |
| Red Hat | Multicluster Engine for Kubernetes | — | — | Not affected | CNA |
| Red Hat | Multicluster Engine for Kubernetes | — | — | Not affected | CNA |
| Red Hat | Multicluster Engine for Kubernetes | — | — | Not affected | CNA |
| Red Hat | OpenShift API for Data Protection | — | — | Not affected | CNA |
| Red Hat | OpenShift API for Data Protection | — | — | Not affected | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
- multicluster engine for Kubernetes 2.1 VendorRed Hat Affected — Fixed in 1784905766 Patch available CNA
- multicluster engine for Kubernetes 2.1 VendorRed Hat Affected — Fixed in 1784905766 Patch available CNA
- multicluster engine for Kubernetes 2.11 VendorRed Hat Affected — Fixed in 1784945966 Patch available CNA
- multicluster engine for Kubernetes 2.17 VendorRed Hat Affected — Fixed in 1784856942 Patch available CNA
- multicluster engine for Kubernetes 2.6 VendorRed Hat Affected — Fixed in 1784905804 Patch available CNA
- multicluster engine for Kubernetes 2.8 VendorRed Hat Affected — Fixed in 1784905783 Patch available CNA
- multicluster engine for Kubernetes 2.9 VendorRed Hat Affected — Fixed in 1784905769 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1787001690 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1787055132 Patch available CNA
- Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 1785534428 Patch available CNA
- Red Hat OpenShift Container Platform 4.17 VendorRed Hat Affected — Fixed in 1784914869 Patch available CNA
- Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in 1784912882 Patch available CNA
- Red Hat OpenShift Container Platform 4.19 VendorRed Hat Affected — Fixed in 1784913720 Patch available CNA
- Red Hat OpenShift Container Platform 4.20 VendorRed Hat Affected — Fixed in 1785288843 Patch available CNA
- Red Hat OpenShift Container Platform 4.21 VendorRed Hat Affected — Fixed in 1785301941 Patch available CNA
- Red Hat OpenShift Container Platform 4.22 VendorRed Hat Affected — Fixed in 1785192936 Patch available CNA
- Logging Subsystem for Red Hat OpenShift VendorRed Hat Affected — Fixed in — Not affected CNA
- Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — Not affected CNA
- Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — Not affected CNA
- Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — Not affected CNA
- Multicluster Engine for Kubernetes VendorRed Hat Affected — Fixed in — Not affected CNA
- OpenShift API for Data Protection VendorRed Hat Affected — Fixed in — Not affected CNA
- OpenShift API for Data Protection VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Advanced Cluster Management for Kubernetes 2 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE names CNA · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:multicluster_engine:2.10::el9 | 2.10 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.11::el9 | 2.11 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.17::el9 | 2.17 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.6::el9 | 2.6 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.8::el9 | 2.8 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine:2.9::el9 | 2.9 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el9 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el9 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.16::el9 | 4.16 | — | Red Hat |
| cpe:/a:redhat:openshift:4.17::el9 | 4.17 | — | Red Hat |
- cpe:/a:redhat:multicluster_engine:2.10::el9 Versions 2.10 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.11::el9 Versions 2.11 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.17::el9 Versions 2.17 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.6::el9 Versions 2.6 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.8::el9 Versions 2.8 — ·Red Hat
- cpe:/a:redhat:multicluster_engine:2.9::el9 Versions 2.9 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.16::el9 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:openshift:4.17::el9 Versions 4.17 — ·Red Hat
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift:4.18::el9 | 4.18 | — | Red Hat |
| cpe:/a:redhat:openshift:4.19::el9 | 4.19 | — | Red Hat |
| cpe:/a:redhat:openshift:4.20::el9 | 4.20 | — | Red Hat |
| cpe:/a:redhat:openshift:4.21::el9 | 4.21 | — | Red Hat |
| cpe:/a:redhat:openshift:4.22::el9 | 4.22 | — | Red Hat |
| cpe:/a:redhat:logging:6 | 6 | — | Red Hat |
| cpe:/a:redhat:multicluster_engine | — | — | Red Hat |
| cpe:/a:redhat:openshift_api_data_protection:1 | 1 | — | Red Hat |
| cpe:/a:redhat:acm:2 | 2 | — | Red Hat |
| cpe:/a:redhat:openshift:4 | 4 | — | Red Hat |
- cpe:/a:redhat:openshift:4.18::el9 Versions 4.18 — ·Red Hat
- cpe:/a:redhat:openshift:4.19::el9 Versions 4.19 — ·Red Hat
- cpe:/a:redhat:openshift:4.20::el9 Versions 4.20 — ·Red Hat
- cpe:/a:redhat:openshift:4.21::el9 Versions 4.21 — ·Red Hat
- cpe:/a:redhat:openshift:4.22::el9 Versions 4.22 — ·Red Hat
- cpe:/a:redhat:logging:6 Versions 6 — ·Red Hat
- cpe:/a:redhat:multicluster_engine Versions — — ·Red Hat
- cpe:/a:redhat:openshift_api_data_protection:1 Versions 1 — ·Red Hat
- cpe:/a:redhat:acm:2 Versions 2 — ·Red Hat
- cpe:/a:redhat:openshift:4 Versions 4 — ·Red Hat
Remediation
Red Hat 16 advisories
- RHSA-2026:56912 Released 2026-08-26 · Red Hat rating CriticalOpenShift Container Platform 4.15.68 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-apiserver-network-proxy-rhel9, registry.redhat.io/openshift4/ose-console +5
- RHSA-2026:56789 Released 2026-08-26 · Red Hat rating CriticalOpenShift Container Platform 4.14.72 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-controller-manager-rhel8, registry.redhat.io/openshift4/ose-azure-cloud-node-manager-rhel8 +5
- RHSA-2026:50758 Released 2026-08-12 · Red Hat rating CriticalOpenShift Container Platform 4.16.68 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +2
Show 13 more Red Hat advisories
- RHSA-2026:47728 Released 2026-08-06 · Red Hat rating CriticalOpenShift Container Platform 4.17.56 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9 +7
- RHSA-2026:48657 Released 2026-08-05 · Red Hat rating CriticalOpenShift Container Platform 4.19.41 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/ose-hypershift-rhel9
- RHSA-2026:48699 Released 2026-08-05 · Red Hat rating CriticalOpenShift Container Platform 4.18.51 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9 +1
- RHSA-2026:48670 Released 2026-08-04 · Red Hat rating CriticalOpenShift Container Platform 4.21.27 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:48676 Released 2026-08-04 · Red Hat rating CriticalOpenShift Container Platform 4.20.32 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-azure-workload-identity-webhook-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
- RHSA-2026:48693 Released 2026-08-04 · Red Hat rating CriticalOpenShift Container Platform 4.22.8 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-hypershift-rhel9, registry.redhat.io/openshift4/ose-installer-artifacts-rhel9 +2
- RHSA-2026:48284 Released 2026-07-29 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.17.1 security update
- multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/hypershift-rhel9-operator
- RHSA-2026:47974 Released 2026-07-29 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.11.4 security update
- multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/hypershift-rhel9-operator
- RHSA-2026:47953 Released 2026-07-29 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.9.6 security update
- multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/hypershift-rhel9-operator
- RHSA-2026:47949 Released 2026-07-29 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.6.13 security update
- multicluster engine for Kubernetes 2.6 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +2
- RHSA-2026:47735 Released 2026-07-29 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.8.9 security update
- multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9 +5
- RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
- RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Criticalmulticluster engine for Kubernetes v2.10.4 security update
- multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17 and 3 more products — RHSA-2026:46885
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-14230 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterPriority MEDIUM 40
- Advisory ·
Red Hat multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17 and 3 more products — RHSA-2026:47388
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-14230 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterPriority MEDIUM 40
Show 5 more groups
- Advisory ·
Red Hat multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17 and 3 more products — RHSA-2026:47735
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-14230 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterPriority MEDIUM 40
- Advisory ·
Red Hat multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17 and 3 more products — RHSA-2026:47949
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-14230 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterPriority MEDIUM 40
- Advisory ·
Red Hat multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17 and 3 more products — RHSA-2026:47953
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-14230 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterPriority MEDIUM 40
- Advisory ·
Red Hat multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17 and 3 more products — RHSA-2026:47974
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-14230 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterPriority MEDIUM 40
- Advisory ·
Red Hat multicluster engine for Kubernetes 2.11, multicluster engine for Kubernetes 2.17 and 3 more products — RHSA-2026:48284
2 records Highest priority Priority MEDIUM 2 MEDIUM
Other records, highest priority first
- TI-2026-14230 Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterPriority MEDIUM 40
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:56789 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:56912 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:50758 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2026:47728 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:48699 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:48657 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:48676 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:48670 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:48693 |
| multicluster engine for Kubernetes 2.1 | Fixed | RHSA-2026:46885 |
| multicluster engine for Kubernetes 2.11 | Fixed | RHSA-2026:47974 |
| multicluster engine for Kubernetes 2.17 | Fixed | RHSA-2026:48284 |
| multicluster engine for Kubernetes 2.6 | Fixed | RHSA-2026:47949 |
| multicluster engine for Kubernetes 2.8 | Fixed | RHSA-2026:47735 |
| multicluster engine for Kubernetes 2.9 | Fixed | RHSA-2026:47953 |
Not affected: 20 products
- Logging Subsystem for Red Hat OpenShift
- Multicluster Engine for Kubernetes
- OpenShift API for Data Protection
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
- Red Hat OpenShift Container Platform 4.22
- multicluster engine for Kubernetes 2.1
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.17
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.8
- multicluster engine for Kubernetes 2.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16242
- 2026-10-03 Alias added: GHSA-43hh-68v6-mf36
References
Advisory 16
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-16242 · CVE Program
- CVE-2026-16242 · NVD
- FIRST EPSS
- GHSA-43hh-68v6-mf36 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-16242 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences