{"id":"CVE-2026-123499","kind":"vulnerability","aliases":["CVE-2026-123499"],"related":[],"title":"Vikunja veans: malicious repo config leaks API tokens to attacker server","description":"Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled server in .veans.yml. When veans runs in an untrusted checkout, it sends VEANS_TOKEN as a Bearer token, or login passwords, TOTP codes and tokens, to that server, granting attackers the victim's Vikunja access.","summary":"The veans tool, before version 2.7.1, reads a server address from a .veans.yml file in the repository it runs in. A malicious repository can point that address at an attacker-controlled server, so veans sends the user's Vikunja API token, login password or TOTP code there.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","developers","package","veans","vikunja"],"not_affected_if":["trusted-repos-only"],"how_to_check":"- Check the installed veans version with `veans --version` and compare it against `2.7.1`.\n- Look for a `.veans.yml` file in any checkout you run veans in, and check whether its server address points somewhere unexpected.","fix":"- veans: move to `2.7.1` or later, per the sources.","status":"open","published_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","triaged_at":"2026-11-08T02:25:12+00:00","updated_at":"2026-11-08T02:25:12+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:25:12Z","model":"claude-haiku-5-5","output":{"fix":"- veans: move to `2.7.1` or later, per the sources.","reach":"local","title":"Vikunja veans: malicious repo config leaks API tokens to attacker server","impact":"high","summary":"The veans tool, before version 2.7.1, reads a server address from a .veans.yml file in the repository it runs in. A malicious repository can point that address at an attacker-controlled server, so veans sends the user's Vikunja API token, login password or TOTP code there.","audience":"developers","category":"package","nicknames":[],"who_cares":["vikunja","veans","developers","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"API tokens and passwords sent to attacker's server, granting Vikunja account access","analyst_note":"","how_to_check":"- Check the installed veans version with `veans --version` and compare it against `2.7.1`.\n- Look for a `.veans.yml` file in any checkout you run veans in, and check whether its server address points somewhere unexpected.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-repos-only"],"who_is_affected":"Teams that run veans against repositories they do not fully trust, such as untrusted pull request checkouts or third-party code, are exposed. The tool sends its token to whatever server the repository's .veans.yml names, so the risk depends on running it in such a checkout. Teams that only run veans on their own trusted repositories can skip it, though updating remains the safe course.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4306,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123499':14A,17A '-2026':13A,16A '2.7.1':28B,73C 'access':128C 'address':32B,49B 'allow':80C 'api':7A,63B,86C 'attack':10A,53B,92C,123C 'attacker-control':52B,91C 'author':83C 'bearer':110C 'captur':85C 'checkout':103C 'ci':18B 'code':69B,116C 'config':5A 'contain':74C 'control':54B,93C 'credenti':76C 'cve':12A,15A 'develop':19B 'exposur':77C 'file':36B 'grant':122C 'leak':6A 'login':65B,113C 'malici':3A,44B,81C 'packag':20B 'password':66B,114C 'point':47B 'read':29B 'repo':4A 'repositori':39B,45B,82C 'run':41B,99C 'send':58B,105C 'server':11A,31B,55B,94C,121C 'specifi':89C 'token':8A,64B,87C,107C,111C,118C 'tool':25B 'totp':68B,115C 'untrust':102C 'user':60B 'vean':2A,21B,24B,57B,71C,98C,106C 'veans.yml':35B,96C 'version':27B 'victim':125C 'vikunja':1A,22B,62B,70C,127C 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Teams that run veans against repositories they do not fully trust, such as untrusted pull request checkouts or third-party code, are exposed. The tool sends its token to whatever server the repository's .veans.yml names, so the risk depends on running it in such a checkout. Teams that only run veans on their own trusted repositories can skip it, though updating remains the safe course.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","developers","medium","package","veans","vikunja"],"campaign_type":null,"search_a":"'-123499':14A,17A '-2026':13A,16A 'api':7A 'attack':10A 'config':5A 'cve':12A,15A 'leak':6A 'malici':3A 'repo':4A 'server':11A 'token':8A 'vean':2A 'vikunja':1A","search_b":"'2.7.1':28B 'address':32B,49B 'api':63B 'attack':53B 'attacker-control':52B 'ci':18B 'code':69B 'control':54B 'develop':19B 'file':36B 'login':65B 'malici':44B 'packag':20B 'password':66B 'point':47B 'read':29B 'repositori':39B,45B 'run':41B 'send':58B 'server':31B,55B 'token':64B 'tool':25B 'totp':68B 'user':60B 'vean':21B,24B,57B 'veans.yml':35B 'version':27B 'vikunja':22B,62B","search_c":"'2.7.1':73C 'access':128C 'allow':80C 'api':86C 'attack':92C,123C 'attacker-control':91C 'author':83C 'bearer':110C 'captur':85C 'checkout':103C 'code':116C 'contain':74C 'control':93C 'credenti':76C 'exposur':77C 'grant':122C 'login':113C 'malici':81C 'password':114C 'repositori':82C 'run':99C 'send':105C 'server':94C,121C 'specifi':89C 'token':87C,107C,111C,118C 'totp':115C 'untrust':102C 'vean':71C,98C,106C 'veans.yml':96C 'victim':125C 'vikunja':70C,127C 'vulner':78C","first_public_at":"2026-10-22T10:00:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123499","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123499","severity":null,"published_at":"2026-11-08T02:16:37+00:00","modified_at":"2026-11-08T02:16:37+00:00","first_seen_at":"2026-11-08T02:21:08+00:00","fetched_at":"2026-11-08T02:21:08+00:00","note":null}],"documents":[{"id":99147,"url":"https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3rrq-h284-5vpx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T10:00:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99148,"url":"https://www.vulncheck.com/advisories/vikunja-veans-before-2.7.1-credential-leak-via-repo-controlled-veans-yml-server","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}