CVE-2026-104632

Summary

The flaw allows a user with Actions write access to bypass the approval requirement by canceling and re-running a workflow, potentially leading to unauthorized execution of code from a fork pull request.

Exploitability

Exploitation is relatively easy given the required Actions write access and the routine nature of canceling and re-running stale fork checks.

Blast radius

If exploited, the flaw could lead to unauthorized execution of code on the repository's runners, potentially compromising the integrity and security of the repository.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the rerun feature for workflow runs from first-time fork pull request contributors until a maintainer approves the run.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.