CVE-2026-83493

Full vulnerability record from the local CVENow database.

Description

A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-06 07:17:52.420000

Last modified

2026-11-06 07:17:57.160000

View original CVE JSON

{
  "id": "CVE-2026-83493",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-06T07:17:52.420",
  "lastModified": "2026-11-06T07:17:57.160",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "defaultStatus": "unknown",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-83493",
      "source": "[email protected]"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526349",
      "source": "[email protected]"
    }
  ]
}