konflux-ci vulnerabilities
CVEs whose affected-version data names the konflux-ci package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-116958Medium· 6.7Konflux-ci: unquoted variable expansion in shell command execution
A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this iss…
CVE-2026-116086High· 8.8Konflux-ci: jq filter injection in github workflow issue management
A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titl…
CVE-2026-116964High· 8.4Konflux-ci: remote code execution via eval() in manifest scripts
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into enviro…
CVE-2026-117681High· 8.0Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in e…
CVE-2026-114217High· 8.6Konflux-ci: github token plaintext exposure in ci/cd scripts
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment c…