CVE-2026-114217

תיאור (מקור, אנגלית)

A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

מדדים

CVSS 3.1

8.6 (HIGH) מקור הציון: NVD CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS — סבירות ניצול

0% (אחוזון 0) נכון ל-1 בנובמבר 2026

CWE

CWE-312

קישורים

• https://access.redhat.com/security/cve/CVE-2026-114217
• https://bugzilla.redhat.com/show_bug.cgi?id=2564218