CVE-2026-83493 Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master
CriticalCVSS 9.1
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat openshift ai | All versions | No fix listed |
| redhat/rhoai/odh-training-cuda128-torch29-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vdb-entry vendor-advisory
- RHBZ#2526349 issue-tracking
- www.cve.org
- nvd.nist.gov