CVE-2026-119194 describes a vulnerability in the pyasn1 library used by the oterm product, where schemaless decoding of BER, CER, or DER data with many distinct long tag IDs causes quadratic CPU usage. This can lead to excessive CPU consumption and reduced service availability when processing attacker-controlled inputs. The issue arises from the decoder's handling of TagSets, which grows inefficiently with certain crafted inputs. No confidentiality or integrity impacts were observed.
CVE-2026-116672 affects the Authlib implementation of RFC 7592 Dynamic Client Registration Management Protocol in the oterm product. The provided example code for the ClientConfigurationEndpoint omits a critical security check that binds the registration_access_token to the specific client being accessed. This omission allows an attacker possessing any valid registration_access_token and knowledge of a client_id to bypass authorization and read, update, or delete that client's registration. The vulnerability is present in versions >=0.14.0 and <0.26.1 and has been fixed in version 0.26.1.
pyasn1 versions up to 0.6.4 contain a denial of service vulnerability in the decoding of binary-encoded ASN.1 REAL values with large mantissas. The decoding process is quadratic in CPU time relative to mantissa length, causing excessive CPU consumption during decode operations. This affects BER, CER, and DER decoders using the shared RealPayloadDecoder. The issue is fixed in pyasn1 version 0.6.5. Applications passing attacker-controlled ASN.1 REAL values to these decoders without strict input limits are vulnerable to CPU exhaustion.
CVE-2026-119196 is a high-severity vulnerability in pyasn1 up to version 0.6.4 used by hermes-agent, where decoding constructed BIT STRING values with many fragments causes quadratic CPU consumption. This can lead to CPU exhaustion and denial of service when processing attacker-controlled ASN.1 data. The issue affects BER and CER decoders and certain schema-driven DER decoding paths. A fix is available in version 2026.4.30.
In pyasn1 versions 0.6.4 and earlier used by hermes-agent, a quadratic-time denial of service vulnerability exists in the decoding of constructed OCTET STRINGs, constructed character strings, and indefinite-length ANY types. This flaw causes CPU usage to grow quadratically with the number of fragments during ASN.1 decoding, potentially allowing an attacker to exhaust CPU resources by supplying crafted ASN.1 input. The vulnerability affects BER and CER decoding paths and certain non-conforming DER inputs when an asn1Spec is used. No confidentiality or integrity impact is reported. A fix is available in version 2026.4.30.
OAuthlib contains a vulnerability in its token grant handlers where an authenticated low-privilege client can supply a different client_id in the token request body, causing grant and scope validation to be performed under that other client identity. This affects the client_credentials and password grant flows. The flaw allows a low-privilege client to obtain tokens with scopes or grant types intended for a higher-privilege client if the application validator authorizes based on the attacker-supplied client_id argument. The issue is fixed in version 2026.9.21_2.
CVE-2026-117681 is a vulnerability in konflux-ci where the user interface proxy disables TLS certificate verification for internal backend service connections in environments without a default service certificate authority. This allows an adjacent network attacker who can intercept traffic to capture a cluster-scoped authentication token with user impersonation rights, potentially leading to full administrative control of the cluster. The issue primarily affects non-OpenShift Kubernetes clusters where the service CA is not present by default.
CVE-2026-116964 is a high-severity vulnerability in konflux-ci that allows an attacker with repository write access to execute arbitrary code within the CI/CD workflow environment. The flaw arises from the injection of shell commands into environment export scripts, causing manifest synchronization scripts to evaluate unvalidated script output. Exploitation can lead to compromise of CI/CD pipelines, theft of authentication tokens and deployment credentials, and unauthorized access to production systems. Mitigation currently relies solely on user review of pull requests or merge requests, with no official patch or fix available.
CVE-2026-116086 is a code injection vulnerability in konflux-ci where an attacker with permission to trigger automated workflows can inject malicious filter commands via crafted issue titles. This leads to information disclosure of sensitive data such as API credentials, deployment keys, and internal notes in workflow logs. The vulnerability affects specific versions of konflux-ci and does not allow direct OS code execution or cluster compromise.
A vulnerability in konflux-ci causes sensitive GitHub access tokens to be stored in plaintext on CI runners without cleanup after execution. This allows a local attacker with access to the CI environment to read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Exploitation requires prior code execution on the runner, limiting remote exploitation. No effective mitigation is currently available according to the vendor advisory.