Description
A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | konflux-ci | 0.2.2, 0.2.3-rc.0 | — |
References
- https://access.redhat.com/security/cve/CVE-2026-116958 vdb-entry
- RHBZ#2564198 issue-tracking