CVE-2026-116964

Name of the Vulnerable Software and Affected Versions konflux-ci (affected versions not specified)

Description A flaw allows an attacker with repository write access to achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. The issue occurs when shell commands are injected into environment export scripts, causing manifest synchronization scripts to dynamically evaluate unvalidated script output. This can lead to the compromise of CI/CD pipelines, theft of sensitive authentication tokens and deployment credentials, and unauthorized access to production systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.