CVE-2026-87049
Description
A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform (GCP) Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without sufficient authorization checks, an attacker could gain highly privileged access to GitHub and cloud resources, potentially leading to unauthorized control.
Statement
Important: The operator-foundry component in Konflux is susceptible to an issue where overly broad GitHub Actions workflow permissions and GCP Workload Identity Federation credentials can be exposed to untrusted external actors. This misconfiguration allows an attacker to obtain highly privileged GitHub tokens and cloud credentials, potentially compromising the CI/CD pipeline and associated cloud resources.
Mitigation
To mitigate this vulnerability, restrict GitHub Actions workflow permissions by moving broad `permissions:` blocks from the workflow level to specific jobs, pruning them to the minimum required. Pin third-party reusable workflows to a full 40-character commit SHA instead of a version tag. Implement author-association checks (OWNER/MEMBER/COLLABORATOR) or maintainer-applied labels for jobs triggered by untrusted events (e.g., `pull_request_target`, `issue_comment`) that receive `id-token: write` or repository secrets. Additionally, configure the GCP Workload Identity Federation provider's attribute condition to only accept tokens from protected-branch workflow runs.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
