CVE-2026-116086
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A flaw was found in konflux-ci that allows an attacker with permission to trigger automated workflow runs to cause information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing injection of malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes may be exposed in workflow logs.
Risk Assessment
An attacker can gain access to sensitive data such as API credentials and deployment keys, potentially leading to further attacks. Exposure of this information in logs can be used for privilege escalation.
Recommendation
Update konflux-ci to a version containing the fix. Restrict access to workflow logs and regularly review them for data leaks.
Other vulnerabilities in konflux-ci
See all- CVE-2026-116958Medium
A flaw was found in konflux-ci that allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker able to supply arguments to the affected scripts could trigger unintended command substitution, executing commands with the privileges of the deployment runner.
- CVE-2026-117681High
A flaw was found in konflux-ci that allows privilege escalation when the user interface proxy automatically disables TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.
- CVE-2026-116964High
A flaw was found in konflux-ci that allows an attacker with repository write access to achieve arbitrary code execution within the CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows compromise of CI/CD pipelines, theft of sensitive authentication tokens and deployment credentials, and unauthorized access to production systems.
- CVE-2026-114217High
A flaw was found in konflux-ci where CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.
Original NVD description (English source)
A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS