Vulnerability · Published Oct 31, 2026 · Assigned by redhat

CVE-2026-116964Konflux-ci: remote code execution via eval() in manifest scripts

High 8.4

In plain English

A high-severity code injection in konflux-ci. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.

Affected products (as reported)

Vendor	Product	Versions
	konflux-ci	0.2.20.2.3-rc.0

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

References

https://access.redhat.com/security/cve/CVE-2026-116964 vdb-entry, x_refsource_REDHAT
RHBZ#2564209 issue-tracking, x_refsource_REDHAT