{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/konflux-ci/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:konflux:konflux-ci:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-114217"},{"cvss":8.4,"id":"CVE-2026-116964"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["konflux-ci"],"_cs_severities":["high"],"_cs_tags":["credential-exposure","ci-cd","vulnerability","remote-code-execution","konflux-ci"],"_cs_type":"advisory","_cs_vendors":["Konflux"],"content_html":"\u003cp\u003eA vulnerability in konflux-ci involves CI automation scripts failing to sanitize sensitive GitHub access tokens after job execution. These credentials remain in plaintext on the local runner environment, allowing an attacker with local access to the runner to retrieve them and gain unauthorized repository access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eLocal attackers can leverage recovered GitHub access tokens to gain unauthorized access to connected repositories, which could facilitate unauthorized source code modifications or the tampering of release artifacts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all konflux-ci runner instances and audit local file systems for lingering plaintext credentials or temporary CI files.\u003c/li\u003e\n\u003cli\u003eImplement a post-execution cleanup process for CI runners to sanitize environment variables and temporary work directories.\u003c/li\u003e\n\u003cli\u003eRotate all GitHub access tokens that have been utilized by konflux-ci automation jobs.\u003c/li\u003e\n\u003cli\u003eRestrict local access to CI build runners to authorized service accounts only to minimize the risk of credential exposure.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-31T09:56:06Z","date_published":"2026-10-31T09:55:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-konflux-ci-credential-exposure/","summary":"A vulnerability in konflux-ci allows local attackers on build runners to retrieve sensitive GitHub access tokens stored in plaintext by CI automation scripts.","title":"Konflux CI: Plaintext GitHub access token exposure (CVE-2026-114217)","url":"https://feed.craftedsignal.io/briefs/2026-10-konflux-ci-credential-exposure/"}],"language":"en","title":"CraftedSignal Threat Feed - Konflux-Ci","version":"https://jsonfeed.org/version/1.1"}