CVE-2026-87050
Description
A flaw was found in operator-foundry. GitHub Actions and reusable workflows within the component are referenced using mutable tags (e.g., @v0, @v4) instead of fixed commit SHAs. This allows an attacker to potentially alter the code executed in the Continuous Integration (CI) pipeline through an upstream compromise or by re-pointing a tag, leading to unauthorized code execution or manipulation.
Statement
This vulnerability is rated as having a Moderate impact for Red Hat products because successful exploitation relies on a compromised upstream third-party repository or unauthorized tag manipulation, presenting a high attack complexity. The flaw exists within CI automation workflows for operator-foundry in Konflux rather than customer runtime environments. Consequently, risks are confined to the pipeline build phase and do not directly expose deployed services to immediate compromise.
Mitigation
To mitigate this issue, Konflux users should ensure that all `uses:` references within their GitHub Actions workflows for `operator-foundry` are explicitly pinned to a full 40-character commit SHA. This prevents silent code changes through mutable tags. For example, instead of `@v4`, use `actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1`. This is a configuration change within the GitHub Actions workflow files and does not require service restarts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
