CVE-2026-117681

Name of the Vulnerable Software and Affected Versions konflux-ci (affected versions not specified)

Description A flaw in the user interface proxy allows privilege escalation when Transport Layer Security (TLS) certificate verification is automatically disabled for connections to internal backend services in environments without a default service certificate authority. The proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests. An adjacent network attacker who can intercept traffic may capture these credentials to obtain full administrative control of the cluster.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.