{"id":"CVE-2026-117681","aliases":["EUVD-2026-114682","GHSA-6rhq-p65w-3v27"],"status":"published","title":"Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone","description":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00097,"percentile":0.00707,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-295"],"published":"2026-10-31T08:57:35Z","modified":"2026-11-04T02:30:26Z","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-117681","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2563233","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117681","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6rhq-p65w-3v27"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/117xxx/CVE-2026-117681.json","tags":["advisory"]},{"url":"https://github.com/konflux-ci/konflux-ci","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-117681","title":"Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone","description":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.","status":"published","published":"2026-10-31T08:57:35.252Z","modified":"2026-11-02T20:58:17.246Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-295"],"updated_at":"2026-11-03T00:01:30.510858Z"}],"euvd":[{"id":"EUVD-2026-114682","description":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.","status":"published","published":"2026-10-31T08:57:35Z","modified":"2026-11-02T20:58:17Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T05:08:36.865312Z"}],"ghsa":[{"id":"GHSA-6rhq-p65w-3v27","title":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user...","description":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.","status":"published","published":"2026-10-31T09:31:14Z","modified":"2026-10-31T09:31:25Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:14:53.83641Z"}],"nvd":[{"id":"CVE-2026-117681","description":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.","status":"published","published":"2026-10-31T09:16:33.487Z","modified":"2026-11-02T21:17:25.747Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-03T00:02:42.364722Z"}],"osv":[{"id":"CVE-2026-117681","title":"Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone","description":"A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.","status":"published","published":"2026-10-31T08:57:35.252Z","modified":"2026-11-04T02:30:26.288406518Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-04T02:55:01.518827Z"}]}}