{}

{}

{}

{"bugzilla": {"description": "operator-foundry: operator-foundry: GitHub Actions and reusable workflow not pinned to commit SHA", "id": "2530050", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530050"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-829", "details": ["A flaw was found in operator-foundry. GitHub Actions and reusable workflows within the component are referenced using mutable tags (e.g., `@v0`, `@v4`) instead of fixed commit SHAs. This allows an attacker to potentially alter the code executed in the Continuous Integration (CI) pipeline through an upstream compromise or by re-pointing a tag, leading to unauthorized code execution or manipulation."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, Konflux users should ensure that all `uses:` references within their GitHub Actions workflows for `operator-foundry` are explicitly pinned to a full 40-character commit SHA. This prevents silent code changes through mutable tags. For example, instead of `@v4`, use `actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1`. This is a configuration change within the GitHub Actions workflow files and does not require service restarts."}, "name": "CVE-2026-87050", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87050\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87050"], "statement": "Moderate impact. The `operator-foundry` component within Konflux utilizes GitHub Actions and reusable workflows that reference mutable tags. This practice introduces a supply chain risk, as an upstream compromise or tag re-point could silently alter the code executed in the CI pipeline, potentially leading to unauthorized code execution or data manipulation during the build process.", "threat_severity": "Moderate"}