CVE-2026-116086

{
  "etk_id": "ETK-2026-3162",
  "cve_id": "CVE-2026-116086",
  "display_id": "CVE-2026-116086",
  "ghsa_id": "GHSA-h98f-8r5p-hq5j",
  "euvd_id": "EUVD-2026-114680",
  "status": "published",
  "anchor_state": "anchored",
  "title": "jq filter injection in konflux-ci workflows",
  "summary": "Konflux CI workflow scripts may process issue titles as jq filter input without sufficient isolation. A user permitted to trigger automated workflows could manipulate repository queries and expose sensitive query results in workflow logs. Exploitation requires workflow-triggering permission.",
  "mitigation": "Restrict workflow-triggering permissions and prevent untrusted issue titles from reaching the affected query logic until the scripts use safely constrained filter inputs. Review affected workflow logs and rotate any credentials or keys that may have been exposed.",
  "vendor": null,
  "product": "konflux-ci",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.2.2, <= 0.2.2",
        ">= 0.2.3-rc.0, <= 0.2.3-rc.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "konflux-ci",
      "purl": null
    }
  ],
  "cwes": [
    94
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.5456369,
  "t0_at": "2026-10-31T08:55:12.938000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-31T08:55:12.938000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-31T08:55:12.938000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-116086"
    }
  }
}