Arbitrary Code Execution in Konflux-CI Affects Red Hat Systems
CVE-2026-116958

6.7MEDIUM

Key Information:

Status
Vendor
CVE Published:
2 November 2026

What is CVE-2026-116958?

A flaw in konflux-ci has been identified that allows for arbitrary code execution due to improper quoting of shell variables in deployment scripts. This vulnerability can be exploited by a local attacker capable of supplying arguments to these scripts, leading to unintended command substitution. As a result, commands may be executed with the privileges of the deployment runner, potentially compromising the integrity of the system.

References

https://access.redhat.com/security/cve/CVE-2026-116958
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2564198
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue.
.