Bug 2530061 (CVE-2026-87062) - CVE-2026-87062 konflux-operator-tasks: konflux-operator-tasks: GitHub Actions referenced by mutable tag/branch instead of commit SHA
Summary: CVE-2026-87062 konflux-operator-tasks: konflux-operator-tasks: GitHub Actions...
Keywords:
Status: NEW
Alias: CVE-2026-87062
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-08 19:06 UTC by OSIDB Bzimport
Modified: 2026-09-08 19:52 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-08 19:06:26 UTC 
## GitHub Actions referenced by mutable tag/branch instead of commit SHA

**Component:** konflux-operator-tasks

GitHub Actions are referenced by mutable tag or branch (e.g. `securego/gosec@master`, `tektoncd/actions/setup-tektoncd@main`, `chmeliik/checkton`) rather than a full commit SHA, most notably for non-GitHub-owned actions.

### Remediation
Pin every `uses:` to a full 40-character commit SHA (with a trailing `# vX.Y.Z` comment for readability), matching the pattern already used in go-ci.yaml. Prioritise `securego/gosec@master`, `tektoncd/actions/setup-tektoncd@main`, and `chmeliik/checkton` as they are non-GitHub-owned. Enable Renovate `helpers:pinGitHubActionDigests` to keep pins fresh.

---
*Source: Ex-Wing/Glasswing Konflux CI security assessment (Mythos), finding FIND-001*
Note You need to log in before you can comment on or make changes to this bug.