CVE-2026-125637 is a vulnerability in the Konflux UI proxy where hostname values from the KonfluxUI custom resource are inserted into proxy configuration files without proper validation. An authenticated user with permission to modify this resource can inject malicious configuration directives to bypass authentication and authorization controls, potentially exposing internal backend services. Malformed input can also cause the proxy configuration generator to fail, resulting in a denial of service by preventing the proxy from starting. Exploitation requires administrative privileges to modify the custom resource or manage GitOps manifests.