CVE-2026-16242 describes a vulnerability in the Konnectivity proxy-server configuration for hosted control planes in Red Hat OpenShift Container Platform. The agent-facing listener was started without the --cluster-ca-cert option and without token-based agent authentication, resulting in no validation of client certificates. Consequently, a remote attacker who can reach the Konnectivity cluster endpoint can establish an unauthenticated agent connection, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic. This affects the confidentiality, integrity, and availability of communications between the control plane and nodes. The vulnerability is rated critical by Red Hat with a CVSS v3 base score of 9.4. The affected products include Red Hat OpenShift Container Platform versions >=4.20.0 <4.20.32 and multicluster engine for Kubernetes versions >=2.6.0 <2.6.13, among others. Red Hat advises restricting network access to the Konnectivity cluster endpoint until an update that configures proper agent authentication is applied.

An unauthenticated remote attacker with network access to the Konnectivity cluster endpoint can connect as an agent without presenting a valid client certificate or token. This allows the attacker to join the routing pool and intercept control-plane-to-node traffic, potentially proxying, inspecting, modifying, or dropping it. The impact affects confidentiality, integrity, and availability of critical control-plane communications, which can compromise the security and stability of the Kubernetes clusters managed by Red Hat OpenShift Container Platform.

Red Hat advises restricting network access to the Konnectivity cluster (agent) endpoint to trusted worker networks until an update is applied that enforces proper agent authentication via client certificates or tokens. For NodePort or LoadBalancer publishing, ingress to port 8091 should be limited to worker node subnet ranges. For Route-based publishing, access to the Konnectivity route should be restricted to trusted networks. These mitigations reduce the risk of unauthenticated attackers reaching the vulnerable endpoint but do not replace the need for the official fix. Check Red Hat advisories for updates and apply them when available.