CVE-2026-116964
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
A flaw was found in konflux-ci that allows an attacker with repository write access to achieve arbitrary code execution within the CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows compromise of CI/CD pipelines, theft of sensitive authentication tokens and deployment credentials, and unauthorized access to production systems.
Risk Assessment
An attacker can execute arbitrary code in the CI/CD pipeline, stealing sensitive credentials and gaining access to production systems. This can lead to a serious supply chain security breach.
Recommendation
Update konflux-ci to a version containing the fix. Restrict repository write access and regularly rotate tokens and deployment credentials.
Other vulnerabilities in konflux-ci
See all- CVE-2026-116958Medium
A flaw was found in konflux-ci that allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker able to supply arguments to the affected scripts could trigger unintended command substitution, executing commands with the privileges of the deployment runner.
- CVE-2026-117681High
A flaw was found in konflux-ci that allows privilege escalation when the user interface proxy automatically disables TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.
- CVE-2026-116086High
A flaw was found in konflux-ci that allows an attacker with permission to trigger automated workflow runs to cause information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing injection of malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes may be exposed in workflow logs.
- CVE-2026-114217High
A flaw was found in konflux-ci where CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.
Original NVD description (English source)
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS