Live › vulnerability › CVE-2026-116958
Deployment scripts in konflux-ci do not quote shell variables properly. A local attacker who can pass arguments to those scripts can trigger command substitution and run commands with the deployment runner's privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 21:35 UTC. All times on this page are UTC.
Teams that run konflux-ci deployment scripts on a runner and let untrusted users or inputs reach the script arguments are exposed. The sources do not say which versions are affected or which scripts are involved. Teams that do not run these deployment scripts can skip it.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.
This page as .md · .json · in your agent: get_signal("CVE-2026-116958")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.