{"id":"CVE-2026-83493","kind":"vulnerability","aliases":["CVE-2026-83493"],"related":[],"title":"distributed-workloads: pull request workflow can leak repository secrets to attackers","description":"A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.","summary":"A workflow in the distributed-workloads project runs untrusted code from pull requests with the base repository's secrets. An attacker who submits a crafted pull request could steal the Snyk token and the default write token, gaining access to the Snyk integration and possible control of the repository.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","github-actions","other","snyk"],"not_affected_if":["no-pull_request_target-workflow","no-secrets-in-workflow"],"how_to_check":"- Look for a `pull_request_target` trigger in the `.github/workflows` files of the distributed-workloads repository.\n- Check whether that workflow checks out or runs code from the pull request head while secrets such as `SNYK_TOKEN` are available.","fix":null,"status":"open","published_at":"2026-11-06T07:17:52+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","triaged_at":"2026-11-06T07:41:56+00:00","updated_at":"2026-11-06T07:41:56+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-06T07:41:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"distributed-workloads: pull request workflow can leak repository secrets to attackers","impact":"high","summary":"A workflow in the distributed-workloads project runs untrusted code from pull requests with the base repository's secrets. An attacker who submits a crafted pull request could steal the Snyk token and the default write token, gaining access to the Snyk integration and possible control of the repository.","audience":"developers","category":"other","nicknames":[],"who_cares":["github-actions","ci","snyk"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker steals CI secrets and gains write access to the repository","analyst_note":"Find the NVD record and the affected workflow file or commit to confirm which repository and versions are affected and whether a fix exists.","how_to_check":"- Look for a `pull_request_target` trigger in the `.github/workflows` files of the distributed-workloads repository.\n- Check whether that workflow checks out or runs code from the pull request head while secrets such as `SNYK_TOKEN` are available.","plain_action":"","needs_analyst":true,"not_affected_if":["no-pull_request_target-workflow","no-secrets-in-workflow"],"who_is_affected":"Projects that use the distributed-workloads GitHub workflow with pull_request_target and secrets are the ones at risk. The sources do not say which versions or branches are affected. Repositories that do not run this workflow can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4251,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-83493':15A,18A 'access':64B,142C 'action':22B 'attack':12A,46B,85C,134C 'author':112C 'base':41B,117C 'ci':19B 'code':35B,107C 'consequ':132C 'control':71B,149C 'could':53B,86C,135C 'craft':50B,100C 'cve':13A,16A 'default':60B,129C 'distribut':2A,30B,81C 'distributed-workload':1A,29B,80C 'exfiltr':136C 'exploit':87C 'flaw':76C 'found':78C 'gain':63B 'github':21B 'github-act':20B 'integr':68B,146C 'lead':139C 'leak':8A 'oper':114C 'possibl':70B 'potenti':148C 'process':105C 'project':32B 'pull':4A,37B,51B,92C,101C,110C 'remot':84C 'repositori':9A,42B,74B,118C,152C 'request':5A,38B,52B,93C,102C,111C 'run':33B 'secret':10A,44B,121C,138C 'sensit':120C 'snyk':24B,56B,67B,125C,145C 'special':99C 'steal':54B 'submit':48B,97C 'target':94C 'token':57B,62B,126C,131C 'unauthor':141C 'untrust':34B,106C 'vulner':89C 'workflow':6A,26B,95C,104C 'workload':3A,31B,82C 'write':61B,130C","nicknames":[],"mitigations":[],"who_affected":"Projects that use the distributed-workloads GitHub workflow with pull_request_target and secrets are the ones at risk. The sources do not say which versions or branches are affected. Repositories that do not run this workflow can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","githubactions","other","snyk","unknown"],"campaign_type":null,"search_a":"'-2026':14A,17A '-83493':15A,18A 'attack':12A 'cve':13A,16A 'distribut':2A 'distributed-workload':1A 'leak':8A 'pull':4A 'repositori':9A 'request':5A 'secret':10A 'workflow':6A 'workload':3A","search_b":"'access':64B 'action':22B 'attack':46B 'base':41B 'ci':19B 'code':35B 'control':71B 'could':53B 'craft':50B 'default':60B 'distribut':30B 'distributed-workload':29B 'gain':63B 'github':21B 'github-act':20B 'integr':68B 'possibl':70B 'project':32B 'pull':37B,51B 'repositori':42B,74B 'request':38B,52B 'run':33B 'secret':44B 'snyk':24B,56B,67B 'steal':54B 'submit':48B 'token':57B,62B 'untrust':34B 'workflow':26B 'workload':31B 'write':61B","search_c":"'access':142C 'attack':85C,134C 'author':112C 'base':117C 'code':107C 'consequ':132C 'control':149C 'could':86C,135C 'craft':100C 'default':129C 'distribut':81C 'distributed-workload':80C 'exfiltr':136C 'exploit':87C 'flaw':76C 'found':78C 'integr':146C 'lead':139C 'oper':114C 'potenti':148C 'process':105C 'pull':92C,101C,110C 'remot':84C 'repositori':118C,152C 'request':93C,102C,111C 'secret':121C,138C 'sensit':120C 'snyk':125C,145C 'special':99C 'submit':97C 'target':94C 'token':126C,131C 'unauthor':141C 'untrust':106C 'vulner':89C 'workflow':95C,104C 'workload':82C 'write':130C","first_public_at":"2026-11-06T07:17:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83493","severity":null,"published_at":"2026-11-06T07:17:52+00:00","modified_at":"2026-11-06T07:17:57+00:00","first_seen_at":"2026-11-06T07:40:16+00:00","fetched_at":"2026-11-06T07:40:16+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}