Arbitrary Code Execution Vulnerability in Konflux-CI by Red Hat
CVE-2026-116964

8.4HIGH

Key Information:

Status
Vendor
CVE Published:
31 October 2026

What is CVE-2026-116964?

A vulnerability in Konflux-CI allows attackers with write access to repositories to execute arbitrary code within CI/CD workflows. By injecting malicious shell commands into environment export scripts, the attacker manipulates manifest synchronization scripts to evaluate unvalidated outputs. This exploitation can lead to severe compromises such as the theft of sensitive tokens and credentials, resulting in unauthorized access to production systems.

References

https://access.redhat.com/security/cve/CVE-2026-116964
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2564209
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue.
.