CVE-2026-87062
Description
A flaw was found in konflux-operator-tasks. GitHub Actions within this component are configured to use mutable tags or branches instead of specific, immutable commit SHAs. This vulnerability could allow a remote attacker to introduce malicious code into the build process if they compromise the referenced mutable tag or branch. Such a compromise could lead to unauthorized code execution or integrity issues within the affected system.
Statement
Moderate impact. The Konflux operator tasks utilize GitHub Actions referenced by mutable tags or branches, which introduces a supply chain risk. This allows for potential integrity compromise if the referenced upstream content changes unexpectedly, leading to unauthorized code execution within Konflux CI/CD pipelines.
Mitigation
To mitigate this issue, Konflux users should ensure that all GitHub Actions referenced within `konflux-operator-tasks` are pinned to their full 40-character commit SHAs. This practice prevents unauthorized code execution by ensuring the exact version of the action is used. Additionally, consider enabling automated tools such as Renovate with `helpers:pinGitHubActionDigests` to maintain these commit SHA pins. Changes to CI/CD configurations will take effect upon the next pipeline run.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability
Technical Impact: Execute Unauthorized Code or Commands
An attacker could insert malicious functionality into the program by causing the program to download code that the attacker has placed into the untrusted control sphere, such as a malicious web site. This could enable the injection of malware, information exposure by granting excessive privileges or permissions to the untrusted functionality, DOM-based XSS vulnerabilities, stealing user's cookies, open redirect to malware (CWE-601), etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
