CVE-2026-87063
Description
A flaw was found in konflux-operator-tasks. The Continuous Integration (CI) process installs the tkn command-line interface (CLI) from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to substitute a malicious binary, potentially leading to the execution of unauthorized code within the CI environment.
Statement
This flaw has a Low impact as it requires a compromised distribution channel to substitute a malicious binary during the installation of the tkn CLI. In Red Hat Konflux CI environments, the tkn CLI is installed from a network download without checksum or signature verification, increasing the risk of supply chain attacks if the distribution channel is compromised.
Mitigation
To mitigate this issue, ensure that the `tkn` CLI is installed with proper checksum and signature verification within your CI pipelines. This can be achieved by downloading the published `checksums.txt` for the `tkn` CLI release and verifying it with `sha256sum -c`. Additionally, verify the sigstore signature using `cosign verify-blob`. Alternatively, configure your CI setup to use a SHA-pinned action for `tkn` CLI installations. This requires modifying existing CI pipeline configurations.
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Other
Executing untrusted code could compromise the control flow of the program. The untrusted code could execute attacker-controlled commands, read or modify sensitive resources, or prevent the software from functioning correctly for legitimate users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
