CVE-2026-87065
Description
A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to escalate privileges or perform unauthorized actions if another vulnerability is exploited within the root-run process.
Statement
This issue has a Low impact on Red Hat products. Tekton task steps in Konflux run as root without sufficient defense-in-depth security context hardening. While this does not directly grant unauthorized access, it could potentially facilitate privilege escalation if an attacker has already compromised a Tekton task, making it easier to bypass security controls.
Mitigation
To mitigate this issue, configure Tekton tasks within Konflux to apply defense-in-depth `securityContext` hardening. For tasks that genuinely require root privileges, explicitly drop all unnecessary capabilities by adding `capabilities.drop: [ALL]` alongside `add: [SETFCAP]`, set `allowPrivilegeEscalation: false`, configure `seccompProfile.type: RuntimeDefault`, and enable `readOnlyRootFilesystem: true` with explicit `emptyDir` mounts for scratch paths. For tasks that do not require root, such as `oras` steps, remove `runAsUser: 0` from the task definition. These changes require modifying the Tekton task definitions and reapplying them, which may involve restarting affected pods or pipelines.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Gain Privileges or Assume Identity; Execute Unauthorized Code or Commands; Read Application Data; DoS: Crash, Exit, or Restart
An attacker will be able to gain access to any resources that are allowed by the extra privileges. Common results include executing code, disabling services, and reading restricted data. New weaknesses can be exposed because running with extra privileges, such as root or Administrator, can disable the normal security checks being performed by the operating system or surrounding environment. Other pre-existing weaknesses can turn into security vulnerabilities if they occur while operating at raised privileges.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
