CVE-2026-116086

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116086", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-29T22:56:15.447Z", "datePublished": "2026-10-31T08:55:12.938Z", "dateUpdated": "2026-11-05T15:28:51.653Z"}, "containers": {"cna": {"title": "Konflux-ci: jq filter injection in github workflow issue management", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs."}], "affected": [{"versions": [{"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3-rc.0"}], "packageName": "konflux-ci", "collectionURL": "https://github.com/konflux-ci/konflux-ci", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-116086", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564224", "name": "RHBZ#2564224", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-10-30T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "Improper Control of Generation of Code", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-94: Improper Control of Generation of Code", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "timeline": [{"lang": "en", "time": "2026-10-30T18:23:42.334Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-30T00:00:00.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-02T20:58:07.372Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T15:28:38.277319Z", "id": "CVE-2026-116086", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T15:28:51.653Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T15:28:38.277319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T15:28:44.899Z"}}], "cna": {"title": "Konflux-ci: jq filter injection in github workflow issue management", "credits": [{"lang": "en", "value": "Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"versions": [{"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3-rc.0"}], "packageName": "konflux-ci", "collectionURL": "https://github.com/konflux-ci/konflux-ci", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-10-30T18:23:42.334Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-30T00:00:00.000Z", "value": "Made public."}], "datePublic": "2026-10-30T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-116086", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564224", "name": "RHBZ#2564224", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Improper Control of Generation of Code"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-02T20:58:07.372Z"}, "x_redhatCweChain": "CWE-94: Improper Control of Generation of Code"}}, "cveMetadata": {"cveId": "CVE-2026-116086", "state": "PUBLISHED", "dateUpdated": "2026-11-05T15:28:51.653Z", "dateReserved": "2026-10-29T22:56:15.447Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-31T08:55:12.938Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/konflux-ci/konflux-ci", "defaultStatus": "unaffected", "packageName": "konflux-ci", "versions": [{"status": "affected", "version": "0.2.2"}, {"status": "affected", "version": "0.2.3-rc.0"}]}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs."}], "id": "CVE-2026-116086", "lastModified": "2026-11-05T16:17:34.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116086", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T15:28:38.277319Z", "version": "2.0.3"}}]}, "published": "2026-10-31T09:16:33.223", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-116086"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564224"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank EVIL0RD (GitHub: https://github.com/EVIL0RD - warlockdarkarmy@gmail.com) for reporting this issue.", "bugzilla": {"description": "konflux-ci: jq Filter Injection in GitHub Workflow Issue Management", "id": "2564224", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564224"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-94", "details": ["A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-116086", "public_date": "2026-10-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116086\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116086"], "statement": "This vulnerability is rated as Important because authenticated users with workflow dispatch permissions can inject arbitrary filter syntax into query utilities, potentially exposing sensitive repository metadata and deployment secrets in CI logs. The flaw affects Konflux CI environments that automate issue management via dispatch events accepting user-supplied issue parameters. Operational impact is limited to information disclosure within pipeline logging, without enabling direct operating system code execution or cluster compromise.", "threat_severity": "Important"}

{"created": "2026-10-31T01:30:11.554589+00:00", "updated": "2026-10-31T01:30:11.554596+00:00", "vendors": []}