Important severity7.2NVD Advisory· Published Nov 10, 2026
konflux-ci: Unvalidated hostname fields enable Caddyfile config injection in the Konflux UI proxy generator, allowing an unauthenticated route to be spliced ahead of the forward_auth/impersonate authorization chain
CVE-2026-125637
Description
konflux-ci: Unvalidated hostname fields enable Caddyfile config injection in the Konflux UI proxy generator, allowing an unauthenticated route to be spliced ahead of the forward_auth/impersonate authorization chain
Affected products
1Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.