CVE-2026-83493 · Other
NO FIX YET
A workflow in the distributed-workloads project runs untrusted code from pull requests with the base repository's secrets. An attacker who submits a crafted pull request could steal the Snyk token and the default write token, gaining access to the Snyk integration and possible control of the repository.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Projects that use the distributed-workloads GitHub workflow with pull_request_target and secrets are the ones at risk. The sources do not say which versions or branches are affected. Repositories that do not run this workflow can skip it.
Not affected if no-pull_request_target-workflow, no-secrets-in-workflow
Who cares ci, github-actions, snyk
pull_request_target trigger in the .github/workflows files of the distributed-workloads repository.SNYK_TOKEN are available.No fix yet, per the sources.
A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.