Sensitive Token Exposure in konflux-ci by Red Hat
CVE-2026-114217

8.6HIGH

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-114217?

A vulnerability exists in konflux-ci where Continuous Integration automation scripts fail to properly manage GitHub access tokens. These tokens are stored in plaintext on the runner post-execution, creating an opportunity for local attackers with access to the CI environment to read and misuse these credentials. This exposure can lead to unauthorized access to repositories, enabling potential modifications of source code or release artifacts, thus compromising the integrity of the development process.

References

https://access.redhat.com/security/cve/CVE-2026-114217
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2564218
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue.
.