Konflux-ci: Remote code execution via eval() in manifest scripts
Summary
Konflux (konflux-ci), an open-source Kubernetes-native CI/CD platform, contains a flaw in its environment export and manifest synchronization scripts. An attacker with repository write access, for example through a malicious change that is approved after minimal review, can inject shell commands that are evaluated and executed in the CI/CD workflow. Successful exploitation can expose pipeline tokens, deployment credentials and access to production systems. Organisations that do not run Konflux are not affected.
Affected
- konflux-ci 0.2.2
- konflux-ci 0.2.3-rc.0
Unknown whether 0.2.3 final or later releases are affected.
Fixed in
Unknown. No fixed version has been published in the sources reviewed.
Workaround
- The only mitigation in place is user review of pull and merge requests.
- Red Hat states that no other mitigation is available that meets its criteria.
Exploitation
- No public exploit reported (VulDB).
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- EPSS: 0.34 %.
Our recommendation
- Check whether Konflux (konflux-ci) is used and which version is running.
- If version 0.2.2 or 0.2.3-rc.0 is in use, plan an upgrade as soon as a fixed version is available.
- Limit repository write access to the minimum and require strict review for changes to manifest sync and environment export scripts.
- Review CI secrets and tokens for exposure and rotate them if needed.
- Monitor pipeline changes for unexpected modifications.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE record CVE-2026-116964 access.redhat.com
- Red Hat Bugzilla 2564209 bugzilla.redhat.com
- VulDB CVE-2026-116964 vuldb.com
- VulDB vulnerability 429543 vuldb.com
- OSV CVE-2026-116964 (Vulners) vulners.com
- Strix CVE-2026-116964 www.strix.ai
- Konflux-ci GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:45.
Original description (NVD)
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.