CVE-2026-87049

{}

{}

{}

{"bugzilla": {"description": "operator-foundry: operator-foundry: Over-permissive GITHUB_TOKEN and GCP WIF secrets granted to third-party reusable workflow on untrusted-triggerable events", "id": "2530049", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530049"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-269", "details": ["A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform (GCP) Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without sufficient authorization checks, an attacker could gain highly privileged access to GitHub and cloud resources, potentially leading to unauthorized control."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability, restrict GitHub Actions workflow permissions by moving broad `permissions:` blocks from the workflow level to specific jobs, pruning them to the minimum required. Pin third-party reusable workflows to a full 40-character commit SHA instead of a version tag. Implement author-association checks (OWNER/MEMBER/COLLABORATOR) or maintainer-applied labels for jobs triggered by untrusted events (e.g., `pull_request_target`, `issue_comment`) that receive `id-token: write` or repository secrets. Additionally, configure the GCP Workload Identity Federation provider's attribute condition to only accept tokens from protected-branch workflow runs."}, "name": "CVE-2026-87049", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87049\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87049"], "statement": "Important: The `operator-foundry` component in Konflux is susceptible to an issue where overly broad GitHub Actions workflow permissions and GCP Workload Identity Federation credentials can be exposed to untrusted external actors. This misconfiguration allows an attacker to obtain highly privileged GitHub tokens and cloud credentials, potentially compromising the CI/CD pipeline and associated cloud resources.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "operator-foundry", "vendor": "operator-foundry"}], "created": "2026-09-09T07:00:09.241329+00:00", "updated": "2026-11-09T21:15:13.775074+00:00", "vendors": ["operator-foundry", "operator-foundry$PRODUCT$operator-foundry"]}