{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114217", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-29T22:56:15.444Z", "datePublished": "2026-10-31T08:55:09.219Z", "dateUpdated": "2026-10-31T08:55:09.219Z"}, "containers": {"cna": {"title": "Konflux-ci: github token plaintext exposure in ci/cd scripts", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts."}], "affected": [{"versions": [{"status": "affected", "version": "0.2.2", "versionType": "semver", "lessThanOrEqual": "0.2.2"}, {"status": "affected", "version": "0.2.3-rc.0", "versionType": "semver", "lessThanOrEqual": "0.2.3-rc.0"}, {"status": "affected", "version": "main", "versionType": "semver", "lessThanOrEqual": "main"}], "packageName": "konflux-ci", "collectionURL": "https://github.com/konflux-ci/konflux-ci", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-114217", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564218", "name": "RHBZ#2564218", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-30T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "description": "Cleartext Storage of Sensitive Information", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-312: Cleartext Storage of Sensitive Information", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-10-30T17:54:01.481Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-30T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-10-31T08:55:09.219Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/konflux-ci/konflux-ci", "defaultStatus": "unaffected", "packageName": "konflux-ci", "versions": [{"lessThanOrEqual": "0.2.2", "status": "affected", "version": "0.2.2", "versionType": "semver"}, {"lessThanOrEqual": "0.2.3-rc.0", "status": "affected", "version": "0.2.3-rc.0", "versionType": "semver"}, {"lessThanOrEqual": "main", "status": "affected", "version": "main", "versionType": "semver"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts."}], "id": "CVE-2026-114217", "lastModified": "2026-10-31T09:16:33.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "secalert@redhat.com", "type": "Primary"}]}, "published": "2026-10-31T09:16:33.077", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-114217"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564218"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue.", "bugzilla": {"description": "konflux-ci: GitHub Token Plaintext Exposure in CI/CD Scripts", "id": "2564218", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564218"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.6", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-312", "details": ["A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-114217", "public_date": "2026-10-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114217\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114217"], "statement": "Red Hat Product Security rates this vulnerability as Important because an attacker who achieves execution access on an automation runner can extract persistent authentication secrets, enabling repository modifications and downstream supply chain compromise. This flaw primarily impacts build pipelines utilizing Konflux CI automated release scripts where sensitive authorization tokens persist across workflow steps. Exploitation requires the adversary to already possess code execution capabilities within the pipeline runner environment, which limits spontaneous remote exploitation but carries severe consequences if compromised.", "threat_severity": "Important"}

{"created": "2026-10-31T01:30:11.554751+00:00", "updated": "2026-10-31T01:30:11.554758+00:00", "vendors": []}