Information Disclosure Vulnerability in Konflux-CI by Red Hat
CVE-2026-116086

8.8HIGH

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-116086?

A security flaw exists in Konflux-CI that can be exploited by individuals authorized to trigger automated workflow runs. By supplying specially crafted issue titles to workflow scripts, attackers may unintentionally expose sensitive information due to improper sanitization of user inputs. The affected scripts incorporate these titles directly into data queries, allowing attackers to inject harmful filter commands. Consequently, sensitive data, including API credentials, deployment keys, and internal notes retrieved from repository queries, may be leaked in workflow logs, posing a risk to the integrity and confidentiality of the affected systems.

References

https://access.redhat.com/security/cve/CVE-2026-116086
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2564224
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue.
.