Bug 2530063 (CVE-2026-87064)

Summary: CVE-2026-87064 konflux-operator-tasks: konflux-operator-tasks: GitHub workflows lack explicit least-privilege permissions blocks
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: gbenhaim, niyer, twaugh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in konflux-operator-tasks. The GitHub workflows used by this component do not explicitly define their required permissions. This oversight means the workflows may inherit default access tokens that grant broader privileges than intended. Such excessive permissions could potentially allow an attacker to gain unauthorized access or perform actions beyond the intended scope, leading to information disclosure or unauthorized modifications.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-08 19:06:33 UTC 
## GitHub workflows lack explicit least-privilege permissions blocks

**Component:** konflux-operator-tasks

GitHub workflows do not declare an explicit top-level `permissions:` block, so they inherit the default (often broader) token permissions rather than being scoped to least privilege.

### Remediation
Add `permissions: contents: read` at the top level of every workflow (and at the top of go-ci.yaml), then grant narrower write scopes only where required (e.g. `security-events: write` for SARIF upload).

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-003*