CVE-2026-44246

{
  "id": "CVE-2026-44246",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T21:16:16.543",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1."
    },
    {
      "lang": "es",
      "value": "nnU-Net es un framework de segmentación semántica que adapta automáticamente su pipeline a un conjunto de datos. Antes de la versión 2.4.1, el flujo de trabajo de triaje de incidencias de nnU-Net en .github/workflows/issue-triage.yml es vulnerable a la Inyección de Flujo de Trabajo Agéntico. El flujo de trabajo establece allowed_non_write_users: ${{ github.event.issue.user.login }}, lo que significa que cualquier usuario de GitHub con sesión iniciada que abra una incidencia puede alcanzar este flujo de trabajo agéntico con contenido controlado por el atacante. El título y el contenido del cuerpo de la incidencia no confiables se incrustan directamente en el prompt de anthropics/claude-code-action, y el flujo de trabajo luego ejecuta un agente Claude con capacidad de comando con permiso para comentar y reetiquetar la incidencia actual a través de gh. Debido a que este flujo de trabajo se activa automáticamente en issues.opened, un atacante externo puede enviar una incidencia manipulada que desvía al agente más allá de su propósito previsto de triaje de incidencias e influye en las acciones de incidencia autenticadas. Esta vulnerabilidad se corrige en la versión 2.4.1."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "MIC-DKFZ",
          "product": "nnUNet",
          "versions": [
            {
              "version": "< 2.4.1",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T14:23:08.264352Z",
          "id": "CVE-2026-44246",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:dkfz:nnu-net:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.4.1",
              "matchCriteriaId": "13B07C8B-909B-41F8-913E-B0335C722A90"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}