{"id":"CVE-2026-116958","kind":"vulnerability","aliases":["CVE-2026-116958"],"related":[],"title":"konflux-ci: unquoted shell variables let local users run commands","description":"A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.","summary":"Deployment scripts in konflux-ci do not quote shell variables properly. A local attacker who can pass arguments to those scripts can trigger command substitution and run commands with the deployment runner's privileges.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-runners","infrastructure","konflux-ci","kubernetes"],"not_affected_if":["no-deployment-scripts","untrusted-input-not-reachable"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T21:17:25+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","triaged_at":"2026-11-02T21:37:08+00:00","updated_at":"2026-11-02T21:37:08+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T21:37:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"konflux-ci: unquoted shell variables let local users run commands","impact":"high","summary":"Deployment scripts in konflux-ci do not quote shell variables properly. A local attacker who can pass arguments to those scripts can trigger command substitution and run commands with the deployment runner's privileges.","audience":"developers","category":"infrastructure","nicknames":[],"who_cares":["konflux-ci","ci-runners","kubernetes"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Commands run with the deployment runner's privileges on the host.","analyst_note":"Find the affected versions and the specific deployment scripts from the NVD entry or the konflux-ci advisory; the sources give neither.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-deployment-scripts","untrusted-input-not-reachable"],"who_is_affected":"Teams that run konflux-ci deployment scripts on a runner and let untrusted users or inputs reach the script arguments are exposed. The sources do not say which versions are affected or which scripts are involved. Teams that do not run these deployment scripts can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000646,"input_tokens":4106,"output_tokens":470,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116958':14A,17A '-2026':13A,16A 'affect':94C 'allow':71C 'arbitrari':72C 'argument':44B,91C 'attack':40B,87C 'ci':3A,19B,24B,31B,68C 'ci-runn':18B 'code':73C 'command':11A,50B,54B,103C,106C 'could':96C 'cve':12A,15A 'deploy':26B,57B,83C,112C 'due':75C 'execut':74C,105C 'exploit':97C 'flaw':62C 'found':64C 'improp':77C 'infrastructur':21B 'issu':99C 'konflux':2A,23B,30B,67C 'konflux-ci':1A,22B,29B,66C 'kubernet':25B 'let':7A 'local':8A,39B,86C 'pass':43B 'privileg':60B,109C 'proper':37B 'quot':34B,78C 'run':10A,53B 'runner':20B,58B,113C 'script':27B,47B,84C,95C 'shell':5A,35B,80C 'substitut':51B,104C 'suppli':90C 'trigger':49B,101C 'unintend':102C 'unquot':4A 'user':9A 'variabl':6A,36B,81C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Teams that run konflux-ci deployment scripts on a runner and let untrusted users or inputs reach the script arguments are exposed. The sources do not say which versions are affected or which scripts are involved. Teams that do not run these deployment scripts can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cirunners","infrastructure","konfluxci","kubernetes","medium"],"first_public_at":"2026-11-02T21:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116958","severity":null,"published_at":"2026-11-02T21:17:25+00:00","modified_at":"2026-11-02T21:17:25+00:00","first_seen_at":"2026-11-02T21:35:41+00:00","fetched_at":"2026-11-02T21:35:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}