---
id: "CVE-2026-116086"
kind: "vulnerability"
aliases: ["CVE-2026-116086"]
title: "konflux-ci workflow script leaks credentials through crafted issue titles"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ci", "github-actions", "jq-injection", "konflux-ci", "other"]
not_affected_if: ["no-automated-issue-workflows", "no-workflow-dispatch-issue-management"]
published_at: "2026-10-31T09:16:33+00:00"
first_seen_at: "2026-10-31T09:34:41+00:00"
updated_at: "2026-10-31T09:37:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116086", "first_seen_at": "2026-10-31T09:34:41+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-31T09:37:08+00:00"}]
---

# konflux-ci workflow script leaks credentials through crafted issue titles

A workflow script in konflux-ci puts issue titles straight into data queries without sanitizing them. A user who can trigger workflow runs can inject filter commands and get API credentials, deployment keys and internal notes written into workflow logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Search your konflux-ci workflows and scripts for issue titles interpolated into a jq or gh --jq program (a safe version passes them with jq --arg). Fix version unknown.

## Timeline

- 2026-10-31T09:34:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116086
- 2026-10-31T09:37:08+00:00 analyst — Red Hat CVE page (Bugzilla 2564224, CWE-94) read: jq filter injection in konflux-ci GitHub workflow issue-management script, reached via workflow dispatch events with user-supplied issue parameters; Red Hat rates Important, no mitigation, no fixed version or script name published. Konflux repo PR/commit with fix not found in two searches; versions unknown. Settle by finding the konflux-ci/konflux-ci commit referencing Bugzilla 2564224.

## Documents

- [advisory] Red Hat CVE-2026-116086 https://access.redhat.com/security/cve/CVE-2026-116086

## From the sources

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_