Red Hat Discloses Three High-Severity Konflux CI Vulnerabilities
All three flaws have CVSS scores of 8.0 or higher, including plaintext GitHub token storage in CI environments.
Red Hat publicly disclosed three security vulnerabilities in its Konflux CI software development and deployment platform on 31 October 2026, according to dailysecu.com. The flaws are tracked as CVE-2026-114217, CVE-2026-116964 and CVE-2026-117681, and all three carry CVSS scores of 8.0 or higher.
CVE-2026-114217, with a CVSS score of 8.6, involves GitHub access tokens being stored in plaintext in continuous integration work environments. CVE-2026-116964, scored 8.4, allows an attacker with repository write access to inject and run malicious commands in deployment automation scripts.
The third flaw, CVE-2026-117681, has a CVSS score of 8.0. It involves certificate verification possibly being disabled during internal service communication, which under certain conditions can lead to authentication token theft and privilege escalation.
No exploitation of the three vulnerabilities in real attacks has been confirmed so far.
Quick answers
What are the CVE identifiers for the Konflux CI vulnerabilities?
The three vulnerabilities are tracked as CVE-2026-114217, CVE-2026-116964 and CVE-2026-117681.
Have the Konflux CI vulnerabilities been exploited in real attacks?
No exploitation of the three vulnerabilities in real attacks has been confirmed so far.