Advisory · CVE-2026-117681
Konflux UI proxy drops TLS checks and leaks cluster token
The Konflux user interface proxy automatically disables TLS certificate verification for internal backend connections when no default service certificate authority exists, letting an adjacent attacker intercept a cluster-scoped impersonation token and gain full cluster control.
- Vendor
- Konflux
- Product
- Konflux CI
- Identifier / CWE
- CVE-2026-117681
CWE-295 - Action timing
- Immediate
Explain it like I’m five
The front desk stops checking ID badges for the back office whenever the usual badge checker is missing, and it carries a master key while it does so. Someone standing nearby on the same network can copy that master key.
- 01No default service CA
A Konflux environment lacks a default service certificate authority for internal backend services.
- 02TLS checks disabled
The user interface proxy automatically disables TLS certificate verification for those backend connections.
- 03Token attached
The proxy attaches a cluster-scoped authentication token with user impersonation rights to the requests.
- 04Traffic intercepted
An adjacent network attacker capable of intercepting traffic captures the credentials in transit.
- 05Cluster taken over
The attacker uses the captured token to gain full administrative control of the cluster.
What happened
A flaw in Konflux CI allows privilege escalation when the user interface proxy automatically disables TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster. NVD rates it CVSS 3.1 8.0 (CWE-295), and records builds from 0.2.2-rc.2 onward as affected.
Exploitation needs an adjacent network position and high attack complexity, but the credential at stake is cluster-scoped with impersonation rights, so a successful interception is a full cluster compromise. No fixed release is stated in the sources checked, so none is claimed here.
What to do
- Ensure Konflux environments have a default service certificate authority so the proxy does not fall back to disabling TLS verification.
- Restrict network adjacency to internal backend services and treat proxy-to-backend traffic as credential-bearing.
- Rotate the cluster-scoped tokens used by the UI proxy and review cluster audit logs for impersonation activity.
- Check for unexpected administrative actions or new identities in the cluster.
- Track the vendor fix and apply it when released, then verify TLS verification stays enabled without a default service CA.
Management note
A proxy that silently drops TLS checks turns a network-position weakness into a cluster-wide credential theft. The immediate control is environmental: make sure a service CA exists, and rotate the proxy token as if it may already have been seen.