Konflux: Information disclosure via jq filter injection in issue workflows
Summary
Konflux, the CI/CD platform of the konflux-ci project, contains a flaw in a workflow script that builds data queries from user-supplied issue titles without sufficient sanitization. An attacker with permission to trigger automated workflow runs can inject filter syntax so that repository query results, such as API credentials, deployment keys and internal notes, appear in workflow logs. The attack requires an account with workflow trigger permissions, so exposure depends on whether outside users can open issues that start such workflows. Red Hat rates the issue as Important and reports no code execution or cluster compromise.
Affected
- konflux-ci 0.2.2 (<= 0.2.2)
- konflux-ci 0.2.3-rc.0 (<= 0.2.3-rc.0)
- Default configuration: unaffected (according to Red Hat)
Fixed in
Unknown. No confirmed fixed version was found in the sources reviewed. The official fixed version should be taken from the Red Hat CVE record.
Workaround
- According to Red Hat, no vendor mitigation is available.
- Do not insert issue titles or other user-supplied fields directly into scripts or query strings.
- Pass such values as arguments or environment variables, for example jq --arg.
- Restrict GITHUB_TOKEN permissions and limit the secrets available to issue-triggered workflows.
Exploitation
- OffSeq lists the CVE as not known to be exploited.
- No public proof of concept and no CISA KEV listing were found at the time of research.
Our recommendation
- Check whether any repositories you manage run issue-triggered workflows that build queries from issue titles.
- Apply the vendor fix once it is confirmed; until then, implement the workaround measures above.
- Review workflow logs for exposed credentials and rotate any keys that may have appeared there.
- In public repositories, restrict who can open issues or trigger workflows.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-116086 access.redhat.com
- Red Hat Bugzilla 2564224 bugzilla.redhat.com
- OffSeq threat radar CVE-2026-116086 radar.offseq.com
- konflux-ci pull request 9367 (upstream change, fix not confirmed) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:21.
Original description (NVD)
A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.