{}

{}

{}

{"bugzilla": {"description": "konflux-operator-tasks: konflux-operator-tasks: GitHub Actions referenced by mutable tag/branch instead of commit SHA", "id": "2530061", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530061"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-829", "details": ["A flaw was found in konflux-operator-tasks. GitHub Actions within this component are configured to use mutable tags or branches instead of specific, immutable commit SHAs. This vulnerability could allow a remote attacker to introduce malicious code into the build process if they compromise the referenced mutable tag or branch. Such a compromise could lead to unauthorized code execution or integrity issues within the affected system."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, Konflux users should ensure that all GitHub Actions referenced within `konflux-operator-tasks` are pinned to their full 40-character commit SHAs. This practice prevents unauthorized code execution by ensuring the exact version of the action is used. Additionally, consider enabling automated tools such as Renovate with `helpers:pinGitHubActionDigests` to maintain these commit SHA pins. Changes to CI/CD configurations will take effect upon the next pipeline run."}, "name": "CVE-2026-87062", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87062\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87062"], "statement": "Moderate impact. The Konflux operator tasks utilize GitHub Actions referenced by mutable tags or branches, which introduces a supply chain risk. This allows for potential integrity compromise if the referenced upstream content changes unexpectedly, leading to unauthorized code execution within Konflux CI/CD pipelines.", "threat_severity": "Moderate"}