CVE-2026-114217
A flaw was found in konflux-ci
- Risk score
- 52/100
- CVSS
- 8.6 v3.1
- Published
- 31 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potential…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.6 high
References
Original description
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.
Last activity 31 Oct 2026. Patch Forecast updates every hour.