CVE-2026-101023

A MODERATE severity flaw was found in Gitea, which is bundled as a dependency in Red Hat's Konflux OpenShift Pipeline container images pipelines-pipelines-as-code-controller-rhel9 and pipelines-pipelines-as-code-watcher-rhel9. Gitea's OAuth2 token endpoint verifies the signature and grant of a token submitted with the refresh_token grant type, but does not verify that the submitted token is actually a refresh token. As a result, an attacker who already possesses a valid, unexpired OAuth2 access token for the same OAuth2 application and grant can submit it to the token endpoint and exchange it for a new access token and refresh token, maintaining access to the application beyond the original token's intended expiration. There is no impact to availability. Red Hat rates this flaw as MODERATE (CVSS 3.1 score 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) because exploitation requires possession of a valid access token and the impact is limited to the confidentiality and integrity allowed by the token's granted scopes; this differs from the higher external CISA score of 9.1, which assumes no privileges are required and high confidentiality and integrity impact. Because the impact is MODERATE with a CVSS score below 7.0, the fix for the affected Konflux components has been deferred, as Red Hat does not file trackers for MODERATE severity flaws without a high CVSS score; the residual risk is that an actor who has already obtained a valid access token can prolong that access, limited to the token's granted scopes.