Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Konflux-ci workflow can expose credentials via crafted issue titles

CVE-2026-116086 · published 4 days ago
Summary

If someone can start an automated workflow in Konflux-ci, they could use specially written issue titles to make the workflow reveal confidential data such as API keys, deployment passwords, and internal notes. The workflow script adds the title directly into its queries without filtering it first, so the malicious input is executed and the secrets appear in the run logs. Update the workflow script to clean or validate issue titles, or apply the vendor's patch, to stop this information leak.

Original advisory text
Konflux-ci: jq filter injection in github workflow issue management
A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published31 Oct 2026
Updated2 Nov 2026
First seen31 Oct 2026
Sources
CVE-2026-116086 · NVD
CVE-2026-116086 · MITRE
CVE-2026-116086 · OSV
Track software like this
Free during beta