CVE-2026-116958

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing commands with the privileges of the deployment runner.

• CWE-78

• https://access.redhat.com/security/cve/CVE-2026-116958
• https://bugzilla.redhat.com/show_bug.cgi?id=2564198

Published

Nov 2, 2026

Last Modified

Nov 3, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116900REDAXO before 5.21.4 contains a stored cross-site scripting …5.4
• CVE-2026-11691Insufficient validation of untrusted input in New Tab Page i…3.1
• CVE-2026-11692Use after free in Read Anything in Google Chrome prior to 14…8.3
• CVE-2026-11693Inappropriate implementation in Plugins in Google Chrome pri…8.1
• CVE-2026-11694Use after free in ServiceWorker in Google Chrome prior to 14…7.5
• CVE-2026-11695Inappropriate implementation in Passwords in Google Chrome p…4.3
• CVE-2026-11696Uninitialized Use in Video in Google Chrome on Windows prior…5.3
• CVE-2026-116964A flaw was found in konflux-ci. An attacker with repository …8.4
• CVE-2026-11697Insufficient validation of untrusted input in UI in Google C…9.6
• CVE-2026-11698Use after free in Bluetooth in Google Chrome on Mac prior to…8.8
• CVE-2026-11699Use after free in Bluetooth in Google Chrome on Mac prior to…8.8
• CVE-2026-1170A vulnerability was detected in birkir prime up to 0.4.0.bet…5.5