CVE-2026-16242 -- CVSS 9.4 Vulnerability Briefing

CVE-2026-16242 | CVSS 9.4 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-16242 is an authentication and transport-security configuration flaw in the Konnectivity proxy server used by hosted Kubernetes control planes, affecting its agent-facing listener.

Technical Detail

The agent-facing Konnectivity listener can be started without the --cluster-ca-cert option and without token-based agent authentication. This configuration omits expected certificate validation and agent authentication controls, allowing an unauthenticated party able to reach the listener to attempt connections as an agent. Successful exploitation could permit unauthorized interaction with the control-plane connectivity proxy and compromise the integrity or confidentiality of traffic handled through that channel.

Exploitation Status

No known exploit has been reported as of July 27, 2026. This CVE is not listed in CISA's Known Exploited Vulnerabilities Catalog.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Treat this as a critical-priority configuration remediation. Ensure Konnectivity proxy agent-facing listeners are configured with --cluster-ca-cert and token-based agent authentication, and deploy vendor or platform updates that enforce these settings where available. Restrict network access to the agent-facing listener so that only authorized cluster agents can reach it, and do not expose the listener to untrusted networks. Audit Konnectivity proxy startup arguments, listener configuration, connection logs, and unexpected agent registrations or connections for evidence of unauthorized access. No specific detection signatures or supported workaround beyond correcting the configuration have been confirmed.