CVE-2026-123499 · Package
NO FIX YET · SEE WHAT TO DO
The veans tool, before version 2.7.1, reads a server address from a .veans.yml file in the repository it runs in. A malicious repository can point that address at an attacker-controlled server, so veans sends the user's Vikunja API token, login password or TOTP code there.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run veans against repositories they do not fully trust, such as untrusted pull request checkouts or third-party code, are exposed. The tool sends its token to whatever server the repository's .veans.yml names, so the risk depends on running it in such a checkout. Teams that only run veans on their own trusted repositories can skip it, though updating remains the safe course.
Not affected if trusted-repos-only
Who cares ci, developers, veans, vikunja
veans --version and compare it against 2.7.1..veans.yml file in any checkout you run veans in, and check whether its server address points somewhere unexpected.2.7.1 or later, per the sources.Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.