CVE-2026-117681
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A flaw was found in konflux-ci that allows privilege escalation when the user interface proxy automatically disables TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.
Risk Assessment
An attacker on an adjacent network can intercept the authentication token and gain full administrative privileges in the cluster. This leads to complete compromise of the konflux-ci environment.
Recommendation
Update konflux-ci to a version containing the fix. Ensure TLS certificate verification is enforced and internal traffic is properly secured.
Other vulnerabilities in konflux-ci
See all- CVE-2026-116958Medium
A flaw was found in konflux-ci that allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker able to supply arguments to the affected scripts could trigger unintended command substitution, executing commands with the privileges of the deployment runner.
- CVE-2026-116964High
A flaw was found in konflux-ci that allows an attacker with repository write access to achieve arbitrary code execution within the CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows compromise of CI/CD pipelines, theft of sensitive authentication tokens and deployment credentials, and unauthorized access to production systems.
- CVE-2026-116086High
A flaw was found in konflux-ci that allows an attacker with permission to trigger automated workflow runs to cause information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing injection of malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes may be exposed in workflow logs.
- CVE-2026-114217High
A flaw was found in konflux-ci where CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.
Original NVD description (English source)
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a default service certificate authority. Because the proxy attaches a cluster-scoped authentication token with user impersonation rights to these requests, an adjacent network attacker capable of intercepting traffic can capture the credentials to gain full administrative control of the cluster.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS