Konflux CI: Cleartext storage of GitHub tokens in CI/CD scripts
Summary
Konflux CI automation scripts store GitHub access tokens in plaintext on the CI runner and do not remove them after execution. A local attacker with code execution or access to the CI environment can read these tokens and gain unauthorized repository access, potentially modifying source code or release artifacts. Red Hat rates the issue as Important (CVSS 3.1: 8.6), while VulDB lists a lower score; exploitation requires prior access to the pipeline runner.
Affected
- konflux-ci 0.2.2 (up to and including 0.2.2)
- konflux-ci 0.2.3-rc.0 (up to and including 0.2.3-rc.0)
- konflux-ci main branch (up to and including main)
- Other versions: not affected according to Red Hat's default status.
Fixed in
Unknown.
- No fixed release is named in the sources.
- A likely upstream fix (GitHub PR #9508) is unconfirmed; check whether it is merged and which release includes it.
Workaround
- No official vendor workaround available (per Red Hat).
- Generic measures: restrict access to CI runners (strict RBAC), audit runners and workspaces for leftover credential files, and delete them.
Exploitation
- Not known to be exploited; not listed in CISA KEV.
- No public exploit code or nuclei template known.
- EPSS: 0.09 %.
Our recommendation
- Check whether Konflux CI or copied versions of its scripts are in use.
- If affected: check runners and workspaces for leftover credential files and delete them.
- Rotate GitHub tokens that may have been exposed; use fine-grained, short-lived tokens with minimal scope.
- Prefer ephemeral runners and monitor repository activity for unexpected changes.
- Priority: low if Konflux is not used, high if it is, due to the token-scope risk.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-114217 access.redhat.com
- Red Hat Bugzilla 2564218 bugzilla.redhat.com
- GitHub PR konflux-ci #9508 github.com
- konflux-ci repository github.com
- VulDB CVE-2026-114217 vuldb.com
- VulDB entry 429541 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:41.
Original description (NVD)
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.