Threats affecting pkg:github/konflux-ci

CVE-2026-117681 is a vulnerability in konflux-ci where the user interface proxy disables TLS certificate verification for internal backend service connections in environments without a default service certificate authority. This allows an adjacent network attacker who can intercept traffic to capture a cluster-scoped authentication token with user impersonation rights, potentially leading to full administrative control of the cluster. The issue primarily affects non-OpenShift Kubernetes clusters where the service CA is not present by default.

CVE-2026-116964 is a high-severity vulnerability in konflux-ci that allows an attacker with repository write access to execute arbitrary code within the CI/CD workflow environment. The flaw arises from the injection of shell commands into environment export scripts, causing manifest synchronization scripts to evaluate unvalidated script output. Exploitation can lead to compromise of CI/CD pipelines, theft of authentication tokens and deployment credentials, and unauthorized access to production systems. Mitigation currently relies solely on user review of pull requests or merge requests, with no official patch or fix available.

CVE-2026-116086 is a code injection vulnerability in konflux-ci where an attacker with permission to trigger automated workflows can inject malicious filter commands via crafted issue titles. This leads to information disclosure of sensitive data such as API credentials, deployment keys, and internal notes in workflow logs. The vulnerability affects specific versions of konflux-ci and does not allow direct OS code execution or cluster compromise.

A vulnerability in konflux-ci causes sensitive GitHub access tokens to be stored in plaintext on CI runners without cleanup after execution. This allows a local attacker with access to the CI environment to read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Exploitation requires prior code execution on the runner, limiting remote exploitation. No effective mitigation is currently available according to the vendor advisory.