Vulnerability · Published Oct 31, 2026 · Assigned by redhat

CVE-2026-116086Konflux-ci: jq filter injection in github workflow issue management

High 8.8

In plain English

A high-severity code injection in konflux-ci. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 76.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.

Affected products (as reported)

Vendor	Product	Versions
	konflux-ci	0.2.20.2.3-rc.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-116086 vdb-entry, x_refsource_REDHAT
RHBZ#2564224 issue-tracking, x_refsource_REDHAT