This vulnerability in the Konnectivity proxy-server configuration for hosted control planes in Red Hat OpenShift occurs due to missing authentication mechanisms. Specifically, the agent-facing listener is started without the --cluster-ca-cert parameter and without token-based agent authentication, which means client certificates are not validated. Consequently, an unauthenticated remote attacker with network access to the Konnectivity cluster endpoint can connect as an agent, join the routing pool, and potentially proxy, inspect, modify, or drop traffic between the control plane and nodes. This compromises confidentiality, integrity, and availability of critical control-plane communications.

The vulnerability allows unauthenticated remote attackers to impersonate agents within the Konnectivity proxy routing pool. This can lead to unauthorized interception, modification, or dropping of control-plane-to-node traffic. The impact includes high confidentiality and integrity loss, and some availability impact on the affected OpenShift control plane communications. This could undermine cluster security and stability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-16242 for current remediation guidance. No official fix or temporary workaround is stated in the provided data. Until a patch is available, restrict network access to the Konnectivity cluster endpoint to trusted entities only to reduce exposure.