Bug 2530064 (CVE-2026-87065)

Summary:	CVE-2026-87065 konflux-operator-tasks: konflux-operator-tasks: Tekton task steps run as root without defense-in-depth securityContext hardening
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	gbenhaim, niyer, twaugh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to escalate privileges or perform unauthorized actions if another vulnerability is exploited within the root-run process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-08 19:06:44 UTC

## Tekton task steps run as root without defense-in-depth securityContext hardening

**Component:** konflux-operator-tasks

Tekton task steps run as root (including steps that don't require it, such as `oras` steps) without defense-in-depth securityContext hardening such as dropped capabilities, `allowPrivilegeEscalation: false`, or a restrictive seccomp profile.

### Remediation
Where root/SETFCAP is genuinely required, add `capabilities.drop: [ALL]` alongside `add: [SETFCAP]`, set `allowPrivilegeEscalation: false`, `seccompProfile.type: RuntimeDefault`, and `readOnlyRootFilesystem: true` with explicit emptyDir mounts for scratch paths. Where root is not required (oras steps), drop `runAsUser: 0`.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-004*