Konflux CI CVE-2026-114217

Exploitation requires that a Konflux CI automation script has run and stored a GitHub access token in plaintext on the runner, and that the cleanup of that credential after execution did not occur - the stored token must still be present on disk. The attacker must have local read access to the CI runner/environment (AV:L): a foothold such as a co-located or subsequent CI job on a shared runner, or shell/filesystem access to the runner. UI:R in the input indicates a CI workflow execution must occur to populate the credential. Limiting factors: no remote network vector, no exposure against an attacker who cannot reach the runner filesystem, and the window depends on how long the uncleaned token persists.

Signals point to a real but bounded risk. The CVSS base score of 8.6 looks alarming, but the vector tells the true story: AV:L means the attack is local, not network-reachable, so the 'local attacker with access to the CI environment' framing in the description is consistent with the vector rather than conflicting with it. The high score is driven largely by S:C plus C:H/I:H/A:H, reflecting that a stolen GitHub token crosses a security boundary into source repositories and release artifacts. Note an internal tension worth flagging: the vector states PR:N (no privileges) yet the description requires the attacker to already have access to the CI runner/environment to read the on-disk credentials - in practice some foothold on the runner (a co-tenant job, a malicious build, or shell access) is needed, so PR:N likely overstates ease of access. No EPSS probability, no CISA KEV listing, and no PoC reference are present in the supplied data, so there is no evidence of active or automated exploitation. The vuln.today decision label is 'this_week', not 'act_now' or 'emergency'. Net: a credible credential-theft and supply-chain integrity issue that warrants prompt remediation for Konflux operators, but it is not a mass-exploitable internet-facing emergency - exposure is gated by who can already reach the CI environment.

A CI job runs on a Konflux runner and writes a GitHub access token to plaintext on disk; because it is never cleaned up after execution, the credential persists. An attacker who can read the runner's filesystem - for example via a subsequent or co-tenant CI job, or any local foothold on the shared runner - retrieves the token and uses it to push malicious changes to source or tamper with release artifacts. No public exploit is identified at time of analysis, and exploitation requires local access to the CI environment rather than a remote network vector.