Live › vulnerability › CVE-2026-116964
konflux-ci has a flaw where shell commands injected into environment export scripts are evaluated unchecked by manifest synchronization scripts. An attacker with repository write access can run arbitrary code in the CI/CD workflow and reach stored tokens and deployment credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 09:34 UTC. All times on this page are UTC.
Teams running Konflux CI pipelines whose manifest synchronization scripts eval the output of environment export scripts. Anyone with repository write access, or a malicious pull request approved after a quick review, can run arbitrary code in the CI/CD runner and reach stored tokens and deployment credentials. Repositories where only trusted people can write or approve changes carry lower risk.
No product ranges from the sources yet.
Unknown from the sources.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.
This page as .md · .json · in your agent: get_signal("CVE-2026-116964")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.