{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/konflux-ui/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-125637"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Konflux UI"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Konflux UI proxy contains a vulnerability where hostname values defined in the KonfluxUI custom resource are inserted directly into proxy configuration files without adequate validation or sanitization. This flaw allows an authenticated user with permissions to modify the custom resource to inject malicious configuration directives. Successfully exploiting this enables an attacker to bypass authentication and authorization controls, potentially exposing internal backend services. Furthermore, providing malformed input can cause the configuration generator to fail, resulting in a denial of service (DoS) by preventing the proxy from starting.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow unauthorized access to internal backend services by bypassing authentication controls, or cause a denial of service by rendering the proxy service unable to initialize.\u003c/p\u003e\n","date_modified":"2026-11-12T00:09:19Z","date_published":"2026-11-12T00:09:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-konflux-ui-proxy-vulnerability-cve-2026-125637/","summary":"An authenticated user can exploit a configuration injection flaw in the Konflux UI proxy to bypass security controls or cause a denial of service via malformed hostname inputs in the KonfluxUI custom resource.","title":"Konflux UI Proxy Configuration Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-11-konflux-ui-proxy-vulnerability-cve-2026-125637/"}],"language":"en","title":"CraftedSignal Threat Feed - Konflux UI","version":"https://jsonfeed.org/version/1.1"}