Bug 2530061 (CVE-2026-87062)

Summary:	CVE-2026-87062 konflux-operator-tasks: konflux-operator-tasks: GitHub Actions referenced by mutable tag/branch instead of commit SHA
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	gbenhaim, niyer, twaugh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in konflux-operator-tasks. GitHub Actions within this component are configured to use mutable tags or branches instead of specific, immutable commit SHAs. This vulnerability could allow a remote attacker to introduce malicious code into the build process if they compromise the referenced mutable tag or branch. Such a compromise could lead to unauthorized code execution or integrity issues within the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-08 19:06:26 UTC

## GitHub Actions referenced by mutable tag/branch instead of commit SHA

**Component:** konflux-operator-tasks

GitHub Actions are referenced by mutable tag or branch (e.g. `securego/gosec@master`, `tektoncd/actions/setup-tektoncd@main`, `chmeliik/checkton`) rather than a full commit SHA, most notably for non-GitHub-owned actions.

### Remediation
Pin every `uses:` to a full 40-character commit SHA (with a trailing `# vX.Y.Z` comment for readability), matching the pattern already used in go-ci.yaml. Prioritise `securego/gosec@master`, `tektoncd/actions/setup-tektoncd@main`, and `chmeliik/checkton` as they are non-GitHub-owned. Enable Renovate `helpers:pinGitHubActionDigests` to keep pins fresh.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-001*