EUVD-2026-114681
GHSA-7c88-x24c-93mg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain repository write access
-
DeliveryInject shell commands into environment export script
-
ExploitManifest sync dynamically evaluates unvalidated output
-
ExecutionExecute arbitrary code in CI/CD runner
-
ImpactSteal tokens and reach production systems
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold write access to a repository orchestrated by Konflux-CI so they can modify environment export scripts that feed the pipeline's manifest synchronization step; the vulnerable behavior is that manifest sync scripts dynamically evaluate (execute) the unvalidated output of those export scripts (CWE-94). Limiting factors per the CVSS vector: PR:H means the actor must be an authenticated, privileged contributor (not anonymous), and UI:R indicates a user-interaction/pipeline-trigger step is needed for the malicious script output to be evaluated. Realistic risk therefore scales with how many semi-trusted principals can push to Konflux-managed repos and whether affected pipeline/manifest-sync logic is in use; it is not reachable by unauthenticated outsiders against a default install. |
| Impact | This is a genuine but conditional priority, not a drive-by threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H, base 8.4) encodes the central caveat: the attacker must already hold high privileges - specifically repository write access - and some user interaction is required, so this is an authenticated, insider-or-compromised-contributor abuse path rather than anonymous remote RCE. The scope change (S:C) and full C:H/I:H/A:H impact are what drive the score up, reflecting that a successful injection escapes the component and reaches CI/CD secrets and production systems. The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with the signal mix: there is NO EPSS probability provided, NO CISA KEV listing, and NO public exploit or PoC reference in the input (both references are the Red Hat advisory and its Bugzilla entry). So no automated-exploitation or active-exploitation signal is present. Conflict to flag explicitly: the input Tags include 'Authentication Bypass', but the description and CVSS PR:H both describe a flaw requiring existing write privileges, not a bypass of authentication - verify the tag against the Red Hat advisory. Net: treat as an important supply-chain/CI hardening fix to apply this week, weighted by how many semi-trusted contributors can push to Konflux-managed repos, rather than as an emergency. |
| Exploit ScenarioDerived | A contributor or compromised account with write access to a repository managed by Konflux adds shell metacharacters to a value that lands in an environment export script; when the pipeline's manifest synchronization step runs and dynamically evaluates that script's output, the injected commands execute inside the CI/CD workflow environment. From there the attacker reads pipeline service-account tokens and deployment credentials and pivots toward production. No public exploit identified at time of analysis, and the precise injection sink is only described at a high level in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 31, 2026
Authenticated contributors who hold write access to a Konflux-CI-managed repository can execute arbitrary shell commands inside the CI/CD workflow by injecting payloads into environment export scripts, whose unvalidated output is subsequently evaluated dynamically by manifest synchronization scripts. Successful exploitation gives the attacker control of pipeline execution and exposes authentication tokens, deployment credentials, and onward access to production systems, with a scope change beyond the pipeline component itself. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; the CVSS vector requires a privileged, authenticated actor (PR:H) plus a pipeline-triggering interaction (UI:R), so real-world exposure tracks how many semi-trusted principals can push to Konflux-managed repositories.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so remediation must begin by tracking the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-116964 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2564209 for the patched release and upgrade as soon as it is published. Because the assessed precondition is PR:H, the most direct compensating control is to shrink the population that can satisfy it: restrict write access to Konflux-managed repositories to a minimal set of trusted principals, and audit existing environment export scripts and manifest synchronization configuration for injected or unexpected command content, accepting slower contribution velocity as the trade-off. The CVSS UI:R component also means malicious output must be carried into a pipeline run before it is evaluated, so reviewing and approving pipeline triggers from newly privileged contributors adds a second checkpoint, at the cost of manual review effort. Treat credentials and tokens exposed to Konflux-CI pipelines as potentially compromised until the environment is upgraded and the pipelines re-run.
Affected ProductsAI
The affected product is konflux-ci, reported by Red Hat and tracked as CVE-2026-116964; no CPE identifiers or explicit version ranges were included in the available intelligence, so the vulnerable build lineage is not enumerated here. Authoritative product and version details should be taken from the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-116964 and the associated Bugzilla record at https://bugzilla.redhat.com/show_bug.cgi?id=2564209. Any deployment that runs Konflux-CI pipelines with manifest synchronization logic fed by environment export scripts should be treated as potentially in scope until the advisory confirms otherwise.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-94 (Improper Control of Generation of Code, i.e. code injection): the manifest synchronization stage of the Konflux-CI pipeline dynamically evaluates the output of environment export scripts rather than treating that output as inert data, so a script author who controls the export step effectively controls code that runs inside the pipeline context. Per the assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H, the attack path is network-reachable through normal repository operations, has low complexity, but requires high privileges (an authenticated contributor with repository write access, not an anonymous outsider) and a user-interaction/pipeline-trigger step before the malicious output is evaluated; the scope change reflects that impact escapes the vulnerable pipeline component to the credentials and systems the pipeline can reach. The precise mechanism by which the evaluation step is reached is described only at this level in the available sources, and no CPE strings or version ranges were supplied with the intelligence, so the affected build lineage must be confirmed against the Red Hat advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Requires existing repository write access (PR:H) and a pipeline/manifest-sync trigger (UI:R); injected code escapes the component to steal CI/CD secrets and reach production (S:C, C/I/A:H).
Primary rating from Vendor (redhat).
CVSS VectorNVD
DescriptionNVD
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.
Executive ViewAI
A high-severity vulnerability in Konflux-CI allows authenticated contributors with write access to execute arbitrary commands within the CI/CD pipeline, potentially exposing deployment credentials and enabling lateral movement to production systems. Leadership should prioritize this due to the broad access granted to semi-trusted principals and the critical nature of pipeline integrity.
Restrict write access to trusted contributors, monitor pipeline logs for suspicious command execution, enforce least-privilege for pipeline service accounts, and implement network segmentation to limit lateral movement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB