CVE-2026-116958

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

CVE-2026-116086

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization,...

CVE-2026-114217

A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...

CVE-2026-117681

A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security TLS certificate verification for connections to internal backend services in environments lacking a default service certificate authority...

CVE-2026-116964

A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery CI/CD workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest...