CVE-2026-87063

{}

{}

{}

{"bugzilla": {"description": "konflux-operator-tasks: konflux-operator-tasks: tkn CLI installed from network without checksum or signature verification", "id": "2530062", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530062"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-494", "details": ["A flaw was found in konflux-operator-tasks. The Continuous Integration (CI) process installs the `tkn` command-line interface (CLI) from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to substitute a malicious binary, potentially leading to the execution of unauthorized code within the CI environment."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, ensure that the `tkn` CLI is installed with proper checksum and signature verification within your CI pipelines. This can be achieved by downloading the published `checksums.txt` for the `tkn` CLI release and verifying it with `sha256sum -c`. Additionally, verify the sigstore signature using `cosign verify-blob`. Alternatively, configure your CI setup to use a SHA-pinned action for `tkn` CLI installations. This requires modifying existing CI pipeline configurations."}, "name": "CVE-2026-87063", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87063\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87063"], "statement": "This flaw has a Low impact as it requires a compromised distribution channel to substitute a malicious binary during the installation of the `tkn` CLI. In Red Hat Konflux CI environments, the `tkn` CLI is installed from a network download without checksum or signature verification, increasing the risk of supply chain attacks if the distribution channel is compromised.", "threat_severity": "Low"}

{"created": "2026-09-09T07:00:09.235114+00:00", "updated": "2026-09-09T07:00:09.235120+00:00", "vendors": []}