Описание
A flaw was found in konflux-operator-tasks. The GitHub workflows used by this component do not explicitly define their required permissions. This oversight means the workflows may inherit default access tokens that grant broader privileges than intended. Such excessive permissions could potentially allow an attacker to gain unauthorized access or perform actions beyond the intended scope, leading to information disclosure or unauthorized modifications.
Отчет
This is a Low impact flaw in Konflux operator tasks where GitHub workflows may inherit overly broad default permissions. This could potentially allow for unintended access to repository contents if not explicitly scoped to least privilege, but does not affect the runtime security of deployed Konflux applications.
Меры по смягчению последствий
Explicitly define least-privilege permissions within GitHub workflows. Add permissions: contents: read at the top level of every workflow, including go-ci.yaml, and then grant narrower write scopes only where specifically required, such as security-events: write for SARIF upload. This ensures workflow tokens operate with the minimum necessary permissions, reducing the potential impact of a compromised workflow.
Дополнительная информация
Статус:
2.6 Low
CVSS3
2.6 Low
CVSS3