CVE-2026-116086

Summary

A flaw in konflux-ci allows authenticated attackers with workflow-triggering permissions to inject malicious filter commands into workflow scripts via unsanitized issue titles, leading to exposure of sensitive data such as API credentials and deployment keys in logs.

Exploitability

Requires low-privilege access to trigger automated workflows and knowledge of how to craft malicious issue titles that manipulate query filters.

Blast radius

Successful exploitation leaks internal secrets and configuration data accessible to the workflow, potentially compromising downstream systems and services using those credentials.

Detection

Monitor workflow execution logs for unexpected or verbose output containing structured data (e.g., JSON, key-value pairs) that resembles API responses or configuration values; such output may indicate successful injection of malicious filter commands.

Prioritized remediation

Upgrade to konflux-ci version 2.590 or later, which includes sanitization of user-provided issue titles before use in query filters.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.