Threats tagged 'ghsa-jw7j-xrxx-59jm'

A vulnerability in konflux-ci's Continuous Integration automation scripts causes sensitive GitHub access tokens to be stored in plaintext on the runner without cleanup after execution. A local attacker with access to the CI environment can read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Exploitation requires prior code execution access on the CI runner. No effective mitigation or patch is currently available according to the vendor advisory.