CVE-2026-114217— Konflux-ci: github token plaintext exposure in ci/cd scripts

Quick assessment

Affected

CVE-2026-114217

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 konflux-ci 中发现一个漏洞：持续集成（CI）自动化脚本将敏感的 GitHub 访问令牌以明文形式存储在运行器（runner）上，且执行后未进行清理。拥有 CI 环境访问权限的本地攻击者可读取这些存储的凭证，从而获取对代码仓库的非授权访问权限，进而可能修改源代码或篡改发布产物。

CVSS 8.6 · High EPSS 0.09% · P0 Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1552 · Unsecured Credentials

Affected Version Matrix 3

Vendor	Product	Version Range	Status
None	None	`0.2.2≤ 0.2.2`	affected
		`0.2.3-rc.0≤ 0.2.3-rc.0`	affected
		`main≤ main`	affected

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Konflux-ci: github token plaintext exposure in ci/cd scripts

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

敏感数据的明文存储

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	-	0.2.2	-

II. Public POCs for CVE-2026-114217

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-114217

请登录查看更多情报信息。

Other References for CVE-2026-114217 (2)

https://access.redhat.com/security/cve/CVE-2026-114217 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2564218 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-114217

IV. Related Vulnerabilities

Same weakness: CWE-312