Konflux - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/konflux/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 09:55:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKonflux CI: Plaintext GitHub access token exposure (CVE-2026-114217)https://feed.craftedsignal.io/briefs/2026-10-konflux-ci-credential-exposure/Sat, 31 Oct 2026 09:55:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-konflux-ci-credential-exposure/A vulnerability in konflux-ci allows local attackers on build runners to retrieve sensitive GitHub access tokens stored in plaintext by CI automation scripts.A vulnerability in konflux-ci involves CI automation scripts failing to sanitize sensitive GitHub access tokens after job execution. These credentials remain in plaintext on the local runner environment, allowing an attacker with local access to the runner to retrieve them and gain unauthorized repository access.

Impact

Local attackers can leverage recovered GitHub access tokens to gain unauthorized access to connected repositories, which could facilitate unauthorized source code modifications or the tampering of release artifacts.

Recommendation

  1. Inventory all konflux-ci runner instances and audit local file systems for lingering plaintext credentials or temporary CI files.
  2. Implement a post-execution cleanup process for CI runners to sanitize environment variables and temporary work directories.
  3. Rotate all GitHub access tokens that have been utilized by konflux-ci automation jobs.
  4. Restrict local access to CI build runners to authorized service accounts only to minimize the risk of credential exposure.
]]>highadvisorycredential-exposureci-cdvulnerabilityremote-code-executionkonflux-ci