CVE-2026-117681

A flaw in konflux-ci allows for privilege escalation because the user interface proxy automatically disables TLS certificate verification for internal backend services in environments without a default service certificate authority. Because the proxy includes a cluster-scoped authentication token...

EUVD-2026-114682

A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...

CVE-2026-116964

A flaw in konflux-ci allows an attacker with repository write access to achieve arbitrary code execution within the CI/CD workflow environment. The root cause is the dynamic evaluation of unvalidated script output by manifest synchronization scripts when shell commands are injected into environme...

EUVD-2026-114681

A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest...

CVE-2026-116086

A flaw in konflux-ci allows an attacker with permission to trigger automated workflow runs to cause information disclosure . The vulnerability exists because workflow scripts incorporate user-provided issue titles into data queries without adequate sanitization, enabling the injection of maliciou...

EUVD-2026-114680

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization,...

CVE-2026-114217

A flaw in konflux-ci allows continuous integration (CI) automation scripts to store sensitive GitHub access tokens in plaintext on the runner. Because these credentials are not cleaned up after execution, a local attacker with access to the CI environment can read them to gain unauthorized reposi...

EUVD-2026-114679

A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...

CVE-2026-116958

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

CVE-2026-116086

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization,...

CVE-2026-114217

A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...

CVE-2026-117681

A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...

CVE-2026-116964

A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest...