The vulnerability CVE-2026-16242 affects the Konnectivity proxy-server component of Red Hat multicluster engine for Kubernetes versions before 2.10.4. The agent-facing listener is started without the --cluster-ca-cert option and lacks token-based agent authentication, resulting in no validation of client certificates. Consequently, a remote attacker who can reach the Konnectivity cluster endpoint may connect as an unauthenticated agent, join the routing pool, and proxy, inspect, modify, or drop traffic between the control plane and nodes. This flaw compromises the integrity and confidentiality of control-plane communications. The CVSS v3.1 base score is 9.4 (Critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and integrity with low impact on availability. Red Hat has issued a security advisory (RHSA-2026:47388) addressing this issue with a security update in version 2.10.4.

An attacker with network access to the Konnectivity cluster endpoint can bypass authentication and connect as an unauthenticated agent. This enables the attacker to join the routing pool and potentially proxy, inspect, modify, or drop control-plane-to-node traffic. The impact includes a high risk to confidentiality and integrity of cluster communications, which could lead to unauthorized control or disruption of Kubernetes cluster operations.

Red Hat has released an official security update in multicluster engine for Kubernetes version 2.10.4 that addresses this vulnerability. Users should upgrade to version 2.10.4 or later to remediate the issue. Refer to Red Hat's official documentation and advisories for installation and upgrade instructions: https://access.redhat.com/errata/RHSA-2026:47388 and https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/clusters/cluster_mce_overview#mce-install-intro. No other mitigations are specified by the vendor.