{}

{}

{}

{"bugzilla": {"description": "konflux-operator-tasks: konflux-operator-tasks: GitHub workflows lack explicit least-privilege permissions blocks", "id": "2530063", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2530063"}, "csaw": false, "cvss3": {"cvss3_base_score": "2.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-269", "details": ["A flaw was found in konflux-operator-tasks. The GitHub workflows used by this component do not explicitly define their required permissions. This oversight means the workflows may inherit default access tokens that grant broader privileges than intended. Such excessive permissions could potentially allow an attacker to gain unauthorized access or perform actions beyond the intended scope, leading to information disclosure or unauthorized modifications."], "mitigation": {"lang": "en:us", "value": "Explicitly define least-privilege permissions within GitHub workflows. Add `permissions: contents: read` at the top level of every workflow, including `go-ci.yaml`, and then grant narrower write scopes only where specifically required, such as `security-events: write` for SARIF upload. This ensures workflow tokens operate with the minimum necessary permissions, reducing the potential impact of a compromised workflow."}, "name": "CVE-2026-87064", "public_date": "2026-09-08T19:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87064\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87064"], "statement": "This is a Low impact flaw in Konflux operator tasks where GitHub workflows may inherit overly broad default permissions. This could potentially allow for unintended access to repository contents if not explicitly scoped to least privilege, but does not affect the runtime security of deployed Konflux applications.", "threat_severity": "Low"}