konflux-ci EUVD-2026-114682

Exploitation requires a specific deployment condition: the konflux-ci environment must LACK a default service certificate authority, which triggers the UI proxy to automatically disable TLS certificate verification on connections to internal backend services. The attacker must (1) hold low-privilege authenticated access (CVSS PR:L), (2) occupy an adjacent network position able to intercept the proxy-to-backend traffic (CVSS AV:A - not remotely exploitable across the internet), and (3) succeed against the high-complexity condition (AC:H) that the service-CA is absent. Limiting factors that reduce real-world risk: the flaw does not apply to environments that do provision a default service certificate authority (the default-secure case), requires prior authentication, and requires on-path network adjacency rather than remote reach.

Signals are moderately strong but not top-tier. The CVSS 3.1 vector (AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.0 High) tells a coherent story: the attacker must be adjacent (on the same network segment as the proxy-to-backend traffic), must already hold low-level authenticated access (PR:L), and faces high attack complexity (AC:H) because exploitation depends on a specific, non-default condition - the environment lacking a default service certificate authority, which causes the proxy to disable TLS verification. The payoff is severe: capturing a cluster-scoped impersonation token yields full cluster administrative control, justifying the scope change (S:C) and C:H/I:H/A:H. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious but conditioned flaw. EPSS is not provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit reference in the input, so this is no public exploit identified at time of analysis. Net assessment: a genuine, high-impact escalation path worth prioritized remediation, but gated by adjacency, prior authentication, and a specific missing-service-CA misconfiguration - not a mass-exploitable internet-facing issue. The real-risk picture is bounded chiefly by AC:H and AV:A, not inflated by the 8.0 score.

In a konflux-ci deployment that lacks a default service certificate authority, the UI proxy silently turns off TLS certificate verification for its connections to internal backend services and attaches a cluster-scoped token carrying user-impersonation rights. An attacker with a foothold on an adjacent network segment positions themselves to intercept this proxy-to-backend traffic (e.g. via ARP spoofing or an on-path position) and captures the impersonation token. Replaying that token against the cluster API grants full administrative control. No public exploit reference is provided in the input.