CVE-2026-87065

{}

{}

{}

{"bugzilla": {"description": "konflux-operator-tasks: konflux-operator-tasks: Tekton task steps run as root without defense-in-depth securityContext hardening", "id": "2530064", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530064"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-250", "details": ["A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to escalate privileges or perform unauthorized actions if another vulnerability is exploited within the root-run process."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, configure Tekton tasks within Konflux to apply defense-in-depth `securityContext` hardening. For tasks that genuinely require root privileges, explicitly drop all unnecessary capabilities by adding `capabilities.drop: [ALL]` alongside `add: [SETFCAP]`, set `allowPrivilegeEscalation: false`, configure `seccompProfile.type: RuntimeDefault`, and enable `readOnlyRootFilesystem: true` with explicit `emptyDir` mounts for scratch paths. For tasks that do not require root, such as `oras` steps, remove `runAsUser: 0` from the task definition. These changes require modifying the Tekton task definitions and reapplying them, which may involve restarting affected pods or pipelines."}, "name": "CVE-2026-87065", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87065\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87065"], "statement": "This issue has a Low impact on Red Hat products. Tekton task steps in Konflux run as root without sufficient defense-in-depth security context hardening. While this does not directly grant unauthorized access, it could potentially facilitate privilege escalation if an attacker has already compromised a Tekton task, making it easier to bypass security controls.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "konflux-operator-tasks", "vendor": "konflux-operator-tasks"}], "created": "2026-09-09T07:30:06.334043+00:00", "updated": "2026-11-09T21:15:13.775492+00:00", "vendors": ["konflux-operator-tasks", "konflux-operator-tasks$PRODUCT$konflux-operator-tasks"]}