Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116964— Konflux-ci: remote code execution via eval() in manifest scripts

Quick assessment

Affected
CVE-2026-116964
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 konflux-ci 中发现一个安全漏洞。拥有仓库写入权限的攻击者可在持续集成与持续交付（CI/CD）工作流环境中实现任意代码执行。攻击者通过向环境导出脚本注入 Shell 命令，诱使清单同步脚本动态评估未经验证的脚本输出。一旦成功利用该漏洞，攻击者即可破坏 CI/CD 流水线、窃取敏感的身份认证令牌和部署凭证，并未经授权访问生产系统。

CVSS 8.4 · High EPSS 0.34% · P27

Affected Version Matrix 2

VendorProduct Version RangeStatus
None None 0.2.2≤ 0.2.2 affected
0.2.3-rc.0≤ 0.2.3-rc.0 affected

I. Basic Information for CVE-2026-116964

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Konflux-ci: remote code execution via eval() in manifest scripts
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0.2.2 ~ 0.2.2 -

II. Public POCs for CVE-2026-116964

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116964

请登录查看更多情报信息。

Other References for CVE-2026-116964 (2)

IV. Related Vulnerabilities

Same weakness: CWE-94