CVE-2026-116086: falha de alta gravidade em konflux-ci
Konflux-ci: jq filter injection in github workflow issue management
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.8epss 0.3%
A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
konflux-ciCVEs relacionadas — konflux-ci
No mesmo produto, das mais perigosas para as menos.
CVE-2026-116964HIGHKonflux-ci: remote code execution via eval() in manifest scriptsEPSS 0.3%CVE-2026-116958MEDIUMKonflux-ci: unquoted variable expansion in shell command executionEPSS 0.1%CVE-2026-117681HIGHKonflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyoneEPSS 0.1%CVE-2026-114217HIGHKonflux-ci: github token plaintext exposure in ci/cd scriptsEPSS 0.1%