Live › vulnerability › CVE-2026-114217
Konflux CI automation scripts store GitHub access tokens in plaintext on the CI runner and do not remove them after the job finishes. A local attacker with access to that CI environment can read the tokens and act as the repository, possibly changing source code or release artifacts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 09:34 UTC. All times on this page are UTC.
Teams running Konflux CI automated release pipelines where someone else (another user, job or compromised step) can run code or read files on the same runner. Red Hat says the attacker must already have code execution in the pipeline runner; tokens persist across workflow steps. Single-tenant, ephemeral runners with no other local access are much less exposed. Affected versions and exact scripts are not published.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.
This page as .md · .json · in your agent: get_signal("CVE-2026-114217")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.