konflux-ci CVE-2026-116958

Exploitation requires local access to the konflux-ci deployment context and the ability to supply attacker-controlled arguments to the affected deployment scripts, executing in the context of the deployment runner (PR:H, AV:L). The limiting factors are significant: the attacker must already hold privileges to influence deployment script arguments, the vector is local rather than network, and impact is confined to the privileges of the deployment runner (scope unchanged). This is not remotely or unauthenticated exploitable; it depends on an actor already positioned within the deployment pipeline who can inject shell metacharacters into script arguments.

This is a moderate-severity, locally-exploitable command injection (CWE-78) in konflux-ci deployment scripts, rated CVSS 6.7. The CVSS vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is internally consistent with the description: exploitation is local (AV:L), requires high privileges (PR:H) - namely the ability to supply arguments to the affected deployment scripts as the deployment runner - and yields full confidentiality, integrity, and availability impact within an unchanged scope. The authentication requirement is confirmed as authenticated (PR:H in the provided vector). No EPSS score, no CISA KEV listing, and no proof-of-concept are present in the input; the two references are a Red Hat CVE page and a Bugzilla tracking entry, neither of which is verified working exploit code. The vuln.today priority is 'this_month' rather than act_now or emergency, which aligns with the absence of active-exploitation signals. In practice this is a real but bounded risk: it is a privilege/local-context issue requiring an actor who already controls or can influence arguments to the deployment runner, so it reads more as a hardening/defense-in-depth fix than a widely-exploitable remote threat. Key missing signals: no EPSS, no KEV, no confirmed PoC, and no explicitly listed fixed version in the provided data.

An actor who can supply arguments to a konflux-ci deployment script - for example a user able to influence pipeline parameters feeding the deployment runner - passes a crafted value containing shell metacharacters. Because the script fails to quote shell variables properly, the value is interpreted as command substitution and runs with the privileges of the deployment runner. No public exploit code is identified in the provided data, and exploitation is local and requires existing privileged access.