PT-2026-62112 · Unknown · Meltanohub
CVE-2026-47690
·
Published
2026-07-21
·
Updated
2026-07-21
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
MeltanoHub versions prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173
Description
A flaw in the workflow configuration allows for the exfiltration of the
GITHUB TOKEN which possesses write permissions to the repository. This occurs because the workflow utilizes pull request target, a trigger that executes within the context of the base repository and grants access to secrets.Recommendations
Update to commit 923820de8f64d753951fbbd54f7282a3d5f75173.
Exploit
Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Meltanohub