{"id":"CVE-2026-116964","aliases":["EUVD-2026-114681","GHSA-7c88-x24c-93mg"],"status":"published","title":"Konflux-ci: remote code execution via eval() in manifest scripts","description":"A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00337,"percentile":0.27468,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-10-31T08:57:31Z","modified":"2026-11-06T18:42:34Z","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-116964","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2564209","tags":["issue-tracking","x_refsource_REDHAT","exploit","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116964","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7c88-x24c-93mg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116964.json","tags":["advisory"]},{"url":"https://github.com/konflux-ci/konflux-ci","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-116964","title":"Konflux-ci: remote code execution via eval() in manifest scripts","description":"A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.","status":"published","published":"2026-10-31T08:57:31.115Z","modified":"2026-11-06T18:42:34.286Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-06T19:59:18.98792Z"}],"euvd":[{"id":"EUVD-2026-114681","description":"A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.","status":"published","published":"2026-10-31T08:57:31Z","modified":"2026-11-06T18:42:34Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T20:06:05.664912Z"}],"ghsa":[{"id":"GHSA-7c88-x24c-93mg","title":"A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary...","description":"A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.","status":"published","published":"2026-10-31T09:31:14Z","modified":"2026-10-31T09:31:26Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:14:53.83641Z"}],"nvd":[{"id":"CVE-2026-116964","description":"A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.","status":"published","published":"2026-10-31T09:16:33.357Z","modified":"2026-11-06T19:17:36.463Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-06T22:02:16.10095Z"}],"osv":[{"id":"CVE-2026-116964","title":"Konflux-ci: remote code execution via eval() in manifest scripts","description":"A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.","status":"published","published":"2026-10-31T08:57:31.115Z","modified":"2026-11-08T02:30:24.518688704Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-07T11:15:38.581573Z"}]}}