CVE-2026-114217

The record

A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

Affected packages

Related vulnerabilities

• CVE-2026-120733 Cleartext storage of sensitive information in the user account data in Devolutions Server… CWE-312
• CVE-2026-110200 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to… CWE-312
• CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-312
• CVE-2026-115400 crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows… CWE-312
• CVE-2026-96293 A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint… CWE-312
• CVE-2026-114223 NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information… CWE-312
• CVE-2026-77564 Talos Linux is a Linux distribution built for Kubernetes deployments. CWE-312
• CVE-2026-86280 A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management &… CWE-312