# CVE-2026-116086: Konflux CI filter injection in workflow issue management

Source: https://junglewise.ai/threats/cve-2026-116086-a-flaw-was-found-in-konflux-ci-an-attacker-with-permission-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-116086 · Severity: high · CVSS 8.8 · Published 2026-10-31

Konflux CI is a cloud-native continuous integration system for building and releasing software artifacts. An authenticated attacker with permission to trigger workflow runs can inject malicious commands into issue titles, causing the system to expose sensitive information like API credentials and deployment keys in CI logs. This requires the attacker to already have workflow dispatch permissions within the system.

Technologies: [Konflux CI](https://junglewise.ai/threats/technologies/konflux-ci). Vendors: [Konflux CI](https://junglewise.ai/threats/vendors/konflux-ci).

## Quick answers

**Is CVE-2026-116086 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116086 being exploited in the wild.

**How severe is CVE-2026-116086?** High severity, with a CVSS score of 8.8, published 31 October 2026.

**Which products and versions are affected?** konflux-ci Konflux CI.

**Is there a fix for CVE-2026-116086?** Yes: fixed in <UNKNOWN>. Until then: <UNKNOWN> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116086 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116086?** Check whether you run Konflux CI. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

<UNKNOWN>

## Technical details

The vulnerability is a code injection flaw (CWE-94) in workflow scripts that incorporate user-provided issue titles directly into jq filter queries without proper sanitization. An attacker with workflow dispatch permissions can craft malicious issue titles containing filter syntax to extract sensitive repository metadata and deployment secrets. The flaw results in information disclosure via CI pipeline logs without enabling direct code execution or cluster compromise.

## Affected products

- konflux-ci Konflux CI

## Timeline

- 2026-10-31: disclosed

## References

- [https://github.com/konflux-ci/konflux-ci](https://github.com/konflux-ci/konflux-ci)
- [https://access.redhat.com/security/cve/CVE-2026-116086](https://access.redhat.com/security/cve/CVE-2026-116086)

## Related threats

- [Konflux-ci privilege escalation via TLS certificate verification bypass](https://junglewise.ai/threats/cve-2026-117681-a-flaw-was-found-in-konflux-ci-this-vulnerability-allows)
- [Konflux CI cleartext storage of GitHub access tokens](https://junglewise.ai/threats/cve-2026-114217-a-flaw-was-found-in-konflux-ci-continuous-integration-ci)