Konflux CI CVE-2026-116086

Exploitation requires the attacker to hold the specific privilege to trigger automated workflow runs on the konflux-ci instance (PR:L), and the target deployment must run the affected workflow script that incorporates user-provided issue titles directly into repository data queries without sanitization. The concrete trigger is a crafted issue title embedding filter/query commands. LIMITING FACTORS: this is not anonymously exploitable - the attacker needs an account or role permitted to initiate workflows; impact is bounded by what secrets (API credentials, deployment keys, internal notes) are actually reachable by the affected query and surfaced in workflow logs; no user interaction by a victim is required (UI:N). The precise query/filter syntax exploited is not detailed in the available sources.

This is a credible, prioritizable issue but not an emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H, score 8.8) indicates a network-reachable, low-complexity flaw requiring only low privileges (PR:L) - consistent with the description, which states the attacker must already hold permission to trigger automated workflow runs. The vuln.today decision label is 'this_week', which aligns with a serious-but-not-drop-everything posture. Critically, several signals are MISSING: no EPSS probability was provided, the CVE is NOT in CISA KEV, and no proof-of-concept or exploit reference appears in the input, so exploitation likelihood cannot be quantified. There is also an internal conflict: the description describes only information disclosure (filter/query injection leaking secrets into logs), yet the CVSS impact is rated C:H/I:H/A:H and the tags claim 'RCE' and 'Code Injection' (CWE-94). The integrity and availability impact and the RCE characterization are NOT substantiated by the supplied description - verify with Red Hat before treating this as a code-execution bug. Net: a real supply-chain/CI secret-exposure risk gated behind workflow-trigger privileges, worth remediating this week, but the headline 8.8 likely overstates the impact actually described.

An attacker who holds permission to trigger automated workflow runs on a konflux-ci instance opens or crafts an issue with a title containing injected filter commands. When a workflow script incorporates that title into a repository data query without sanitization, the injected filter broadens the query, and sensitive values - API credentials, deployment keys, and internal notes - are returned and printed into the workflow logs where the attacker can read them. No public exploit code was identified in the provided data, and exploitation requires the attacker to already have the (low) privilege to trigger workflows.