high · CVSS v3 7.8

CVE-2026-116958

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell vari…

Description

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.

Scores

Severity
high
CVSS v2
7.2
CVSS v3
7.8
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-58966

In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis

high

CVE-2026-58970

In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis

high

CVE-2026-58974

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis

high

CVE-2026-58975

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

View analysis