Konflux CI: Plaintext GitHub access token exposure (CVE-2026-114217)
A vulnerability in konflux-ci allows local attackers on build runners to retrieve sensitive GitHub access tokens stored in plaintext by CI automation scripts.
CVE search metadata
CVE search record: CVE-2026-114217. Severity: high. CVSS: 8.6. KEV: no. Product: konflux-ci. Brief: Konflux CI: Plaintext GitHub access token exposure (CVE-2026-114217). Brief link: https://feed.craftedsignal.io/briefs/2026-10-konflux-ci-credential-exposure/
CVE search record: CVE-2026-116964. Severity: high. CVSS: 8.4. KEV: no. Product: konflux-ci. Brief: Konflux CI: Plaintext GitHub access token exposure (CVE-2026-114217). Brief link: https://feed.craftedsignal.io/briefs/2026-10-konflux-ci-credential-exposure/
Triage facts
Revision 1- Applicability
- konflux-ci
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 31, 09:55 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A1Likely
What's new
- 1. added coverage for konflux-ci Oct 31, 09:56 via nvd
A vulnerability in konflux-ci involves CI automation scripts failing to sanitize sensitive GitHub access tokens after job execution. These credentials remain in plaintext on the local runner environment, allowing an attacker with local access to the runner to retrieve them and gain unauthorized repository access.
Impact
Local attackers can leverage recovered GitHub access tokens to gain unauthorized access to connected repositories, which could facilitate unauthorized source code modifications or the tampering of release artifacts.
Recommendation
- Inventory all konflux-ci runner instances and audit local file systems for lingering plaintext credentials or temporary CI files.
- Implement a post-execution cleanup process for CI runners to sanitize environment variables and temporary work directories.
- Rotate all GitHub access tokens that have been utilized by konflux-ci automation jobs.
- Restrict local access to CI build runners to authorized service accounts only to minimize the risk of credential exposure.
Immediate actions
Rotate all GitHub access tokens used by konflux-ci
Audit repository write access for all Konflux-CI projects
Threat Hunt
Identify processes or users with access to runner directories after job completion
Data: Runner file system audit logs, Process execution logs on CI workers
Identify CI/CD pipeline logs showing shell execution or unexpected command output during manifest synchronization
Data: CI/CD pipeline execution logs, Shell audit logs within build containers
Mitigations
Implement post-execution scripts to purge temporary files and environment variables on runners
CVE-2026-114217
Apply security patches or configuration hardening for Konflux-CI
CVE-2026-116964