CVE-2026-114217
説明
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.
詳細
Red Hat Product Security rates this vulnerability as Important because an attacker who achieves execution access on an automation runner can extract persistent authentication secrets, enabling repository modifications and downstream supply chain compromise. This flaw primarily impacts build pipelines utilizing Konflux CI automated release scripts where sensitive authorization tokens persist across workflow steps. Exploitation requires the adversary to already possess code execution capabilities within the pipeline runner environment, which limits spontaneous remote exploitation but carries severe consequences if compromised.
軽減策
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
脆弱性の原因 (CWE) の理解
Confidentiality
Technical Impact: Read Application Data
An attacker with access to the system could read sensitive information stored in cleartext (i.e., unencrypted). Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
謝辞
Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue.
よくある質問
Not sure what something means? Check out our Security Glossary.
エラータ通知の受信を希望しますか? こちらで登録してください。
