{"id":"CVE-2026-123852","kind":"vulnerability","aliases":["CVE-2026-123852"],"related":[],"title":"JetBrains Junie GitHub Action: fork updates let code run with workflow credentials","description":"In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates","summary":"Before version 1.8.0, the JetBrains Junie GitHub Action allowed code execution with the workflow's credentials when a fork was updated. An attacker who can push changes through a fork can run code with the secrets available to the workflow.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","github-actions","jetbrains","junie","package"],"not_affected_if":["action-not-used","version-1.8.0-or-later"],"how_to_check":"- Look for uses of the JetBrains Junie GitHub Action in workflow files under `.github/workflows`\n- Check the pinned action version; anything below `1.8.0` is affected per the sources\n- Review which secrets and tokens the workflow exposes when triggered by fork pull requests","fix":"- JetBrains Junie GitHub Action: upgrade to `1.8.0` or later","status":"open","published_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:06+00:00","updated_at":"2026-11-06T17:45:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T17:45:06Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains Junie GitHub Action: upgrade to `1.8.0` or later","reach":"internet","title":"JetBrains Junie GitHub Action: fork updates let code run with workflow credentials","impact":"high","summary":"Before version 1.8.0, the JetBrains Junie GitHub Action allowed code execution with the workflow's credentials when a fork was updated. An attacker who can push changes through a fork can run code with the secrets available to the workflow.","audience":"developers","category":"package","nicknames":[],"who_cares":["github-actions","junie","jetbrains","ci"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"code runs with workflow credentials and secrets","analyst_note":"Check the NVD entry and the JetBrains advisory for the exact trigger conditions and whether fork pull requests were the only path.","how_to_check":"- Look for uses of the JetBrains Junie GitHub Action in workflow files under `.github/workflows`\n- Check the pinned action version; anything below `1.8.0` is affected per the sources\n- Review which secrets and tokens the workflow exposes when triggered by fork pull requests","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.8.0-or-later","action-not-used"],"who_is_affected":"Repositories that run the JetBrains Junie GitHub Action at a version before 1.8.0, particularly workflows triggered by changes arriving from forks that have access to workflow credentials. Repositories that do not use the action, or that pin 1.8.0 or later, are not affected per the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4169,"output_tokens":601,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123852':15A,18A '-2026':14A,17A '1.8.0':28B,72C 'action':4A,22B,33B,70C 'allow':34B 'attack':48B 'avail':62B 'chang':52B 'ci':19B 'code':8A,35B,58B,73C 'credenti':12A,41B,77C 'cve':13A,16A 'execut':36B,74C 'fork':5A,44B,55B,81C 'github':3A,21B,32B,69C 'github-act':20B 'jetbrain':1A,23B,30B,67C 'juni':2A,24B,31B,68C 'let':7A 'packag':25B 'possibl':79C 'push':51B 'run':9A,57B 'secret':61B 'updat':6A,46B,82C 'version':27B 'via':80C 'workflow':11A,39B,65B,76C","nicknames":[],"mitigations":[],"who_affected":"Repositories that run the JetBrains Junie GitHub Action at a version before 1.8.0, particularly workflows triggered by changes arriving from forks that have access to workflow credentials. Repositories that do not use the action, or that pin 1.8.0 or later, are not affected per the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","githubactions","high","jetbrains","junie","package"],"campaign_type":null,"search_a":"'-123852':15A,18A '-2026':14A,17A 'action':4A 'code':8A 'credenti':12A 'cve':13A,16A 'fork':5A 'github':3A 'jetbrain':1A 'juni':2A 'let':7A 'run':9A 'updat':6A 'workflow':11A","search_b":"'1.8.0':28B 'action':22B,33B 'allow':34B 'attack':48B 'avail':62B 'chang':52B 'ci':19B 'code':35B,58B 'credenti':41B 'execut':36B 'fork':44B,55B 'github':21B,32B 'github-act':20B 'jetbrain':23B,30B 'juni':24B,31B 'packag':25B 'push':51B 'run':57B 'secret':61B 'updat':46B 'version':27B 'workflow':39B,65B","search_c":"'1.8.0':72C 'action':70C 'code':73C 'credenti':77C 'execut':74C 'fork':81C 'github':69C 'jetbrain':67C 'juni':68C 'possibl':79C 'updat':82C 'via':80C 'workflow':76C","first_public_at":"2026-11-06T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123852","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123852","severity":null,"published_at":"2026-11-06T17:17:24+00:00","modified_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}