{"id":"CVE-2026-114217","kind":"vulnerability","aliases":["CVE-2026-114217"],"related":[],"title":"konflux-ci: CI scripts leave GitHub tokens in plaintext on runners","description":"A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.","summary":"Konflux CI automation scripts store GitHub access tokens in plaintext on the CI runner and do not remove them after the job finishes. A local attacker with access to that CI environment can read the tokens and act as the repository, possibly changing source code or release artifacts.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","github-tokens","infrastructure","konflux-ci"],"not_affected_if":["ephemeral-runners","no-konflux-ci","single-tenant"],"how_to_check":"No official check published. Inspect your Konflux release scripts and runner workspaces for GitHub tokens written to files (grep the workspace/home dirs after a job finishes); unknown which files.","fix":null,"status":"open","published_at":"2026-10-31T09:16:33+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","triaged_at":"2026-10-31T09:35:38+00:00","updated_at":"2026-10-31T09:38:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-31T09:35:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"konflux-ci: CI scripts leave GitHub tokens in plaintext on runners","impact":"high","summary":"Konflux CI automation scripts store GitHub access tokens in plaintext on the CI runner and do not remove them after the job finishes. A local attacker with access to that CI environment can read the tokens and act as the repository, possibly changing source code or release artifacts.","audience":"developers","category":"infrastructure","nicknames":[],"who_cares":["konflux-ci","ci","github-tokens"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads GitHub tokens and modifies repositories or release artifacts","analyst_note":"Find the affected konflux-ci versions and the specific scripts from the NVD entry or the project's advisory; confirm whether a fix or cleanup setting exists.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-konflux-ci","ephemeral-runners"],"who_is_affected":"Teams that run konflux-ci pipelines on shared or multi-tenant CI runners where other users or jobs can read the runner's filesystem. The sources do not name affected versions or say which scripts are involved. Teams whose runners are single-tenant and ephemeral, with no other local access, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000669,"input_tokens":4115,"output_tokens":514,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected konflux-ci versions and the specific scripts from the NVD entry or the project's advisory; confirm whether a fix or cleanup setting exists.","search":"'-114217':15A,18A '-2026':14A,17A 'access':33B,54B,91C,108C,122C 'act':64B 'allow':124C 'artifact':74B,132C 'attack':52B,106C 'autom':29B,86C 'chang':69B 'ci':3A,4A,19B,26B,28B,39B,57B,82C,85C,111C 'clean':99C 'code':71B,129C 'continu':83C 'credenti':117C 'cve':13A,16A 'environ':58B,112C 'execut':103C 'finish':49B 'flaw':76C 'found':78C 'gain':119C 'github':7A,21B,32B,90C 'github-token':20B 'infrastructur':23B 'integr':84C 'job':48B 'konflux':2A,25B,27B,81C 'konflux-ci':1A,24B,80C 'leav':6A 'local':51B,105C 'modifi':127C 'plaintext':10A,36B,94C 'possibl':68B 'potenti':123C 'read':60B,114C 'releas':73B,131C 'remov':44B 'repositori':67B,121C 'runner':12A,40B,97C 'script':5A,30B,87C 'sensit':89C 'sourc':70B,128C 'store':31B,88C,116C 'token':8A,22B,34B,62B,92C 'unauthor':120C 'without':98C","nicknames":[],"mitigations":[],"who_affected":"Teams running Konflux CI automated release pipelines where someone else (another user, job or compromised step) can run code or read files on the same runner. Red Hat says the attacker must already have code execution in the pipeline runner; tokens persist across workflow steps. Single-tenant, ephemeral runners with no other local access are much less exposed. Affected versions and exact scripts are not published.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"first_public_at":"2026-10-31T09:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114217","severity":null,"published_at":"2026-10-31T09:16:33+00:00","modified_at":"2026-10-31T09:16:33+00:00","first_seen_at":"2026-10-31T09:34:41+00:00","fetched_at":"2026-10-31T09:34:41+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114217:1236","url":null,"severity":null,"published_at":"2026-10-31T09:38:11+00:00","modified_at":"2026-10-31T09:38:11+00:00","first_seen_at":"2026-10-31T09:38:11+00:00","fetched_at":"2026-10-31T09:38:11+00:00","note":"Red Hat CVE page (reporter-assigned, Important, CWE-312, Bugzilla 2564218) is the only primary source: names no versions, no scripts beyond 'Konflux CI automated release scripts', no fix, and says no mitigation available. Not exploited, no PoC found. Nothing verified; no upstream konflux-ci advisory found."}],"documents":[{"id":31105,"url":"https://access.redhat.com/security/cve/CVE-2026-114217","title":"Red Hat CVE-2026-114217","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}