Konflux UI proxy: Improper TLS certificate validation enables privilege escalation
Summary
The user interface proxy of Konflux, a Kubernetes-native build and supply-chain platform, disables TLS certificate verification for connections to internal backend services where no default service certificate authority is present. The proxy attaches a cluster-scoped token with user impersonation rights to these requests. An adjacent network attacker who can intercept this traffic can capture the token and gain full administrative control of the cluster, although attack complexity is high and low privileges are required.
Affected
- konflux-ci from 0.2.2-rc.2 (according to aggregator data, not confirmed by the vendor)
- Default configuration: unaffected
- Environments without a default service CA, typically non-OpenShift Kubernetes clusters (Red Hat states that the OpenShift service CA prevents the issue)
Fixed in
Unknown. No fixed version has been confirmed by the vendor.
Workaround
- Red Hat: no mitigation is available that meets its criteria.
- Unverified options: provide a CA bundle for the backend services so that TLS verification can be enabled; restrict network access to the proxy-to-backend traffic path; limit the impersonation rights of the proxy service account and rotate its tokens if interception is suspected.
Exploitation
- No public exploit known.
- Not known to be exploited.
- VulDB rates exploitation as difficult.
Our recommendation
- Check whether Konflux or a self-hosted software factory is in use. If not, no action needed.
- If it is in use, provide a CA bundle for backend services and verify the TLS settings of the UI proxy.
- Restrict access to the cluster network segment that carries proxy traffic.
- Limit the impersonation rights of the proxy service account and rotate its tokens if interception is suspected.
- Monitor the Red Hat advisory for a fixed version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page access.redhat.com
- Red Hat Bugzilla 2563233 bugzilla.redhat.com
- VulDB CVE entry vuldb.com
- Konflux reverse-proxy project github.com
- OffSeq threat radar entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:08.
Original description (NVD)
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.