Live › vulnerability › CVE-2026-116086
A workflow script in konflux-ci puts issue titles straight into data queries without sanitizing them. A user who can trigger workflow runs can inject filter commands and get API credentials, deployment keys and internal notes written into workflow logs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 09:34 UTC. All times on this page are UTC.
Repositories using konflux-ci's GitHub workflow for issue management, where a dispatch event accepts a user-supplied issue title and passes it into a jq query. Anyone who can trigger those runs could put jq filter syntax in the title and read secrets such as API credentials, deployment keys and internal notes from the workflow logs. Red Hat says impact is limited to information disclosure in CI logs. Teams that do not run these workflows can skip it.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.
This page as .md · .json · in your agent: get_signal("CVE-2026-116086")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.