Threats tagged 'ghsa-7c88-x24c-93mg'

CVE-2026-116964 is a high-severity vulnerability in konflux-ci that allows an attacker with repository write access to execute arbitrary code within the CI/CD workflow environment. The flaw arises from manifest synchronization scripts dynamically evaluating unvalidated script output via injected shell commands. Exploitation can compromise CI/CD pipelines, expose sensitive authentication tokens and deployment credentials, and lead to unauthorized access to production systems. Mitigation currently relies solely on user review of pull requests or merge requests to prevent malicious commits from being approved.