CVE-2026-114217
Received Received - Intake

Konflux-CI Plaintext GitHub Token Exposure Vulnerability

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: redhat-SADP

Description
A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-114217
EUVD
EUVD-2026-114679

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
konflux konflux-ci *
konflux konflux-ci v0.2.2
konflux konflux-ci v0.2.3-rc.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a flaw in konflux-ci where CI automation scripts store GitHub access tokens in plaintext on the runner without cleanup. A local attacker with CI environment access can read these tokens to gain unauthorized repository access, potentially modifying source code or release artifacts.

Detection Guidance

Check for plaintext GitHub tokens in ~/.git-credentials on CI runners. Commands: cat ~/.git-credentials, grep -r "github.com" ~/.git-credentials, or inspect CI logs for token exposure during workflow execution.

Verify if tokens persist after CI jobs complete by checking file timestamps or running find ~/. -name "*credentials*" to locate sensitive files.

Impact Analysis

An attacker could extract the plaintext token from ~/.git-credentials, use it to authenticate, push malicious code to the repository, modify releases, and compromise the entire Konflux-CI ecosystem. This could lead to supply chain attacks and unauthorized changes.

Mitigation Strategies

Remove plaintext tokens from ~/.git-credentials and use GitHub CLI for secure token handling. Implement cleanup scripts to delete credentials after CI jobs finish.

Rotate exposed GitHub tokens immediately and restrict permissions to minimize impact. Update konflux-ci to versions without this flaw if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart