CVE-2026-55675

Summary

A GitHub Actions workflow vulnerability allows untrusted fork commits to execute malicious Python code with high-privilege secrets, potentially leading to complete repository compromise and secret disclosure.

Exploitability

Easy to exploit with a malicious fork PR that includes attacker-controlled setup.py or build hooks, requiring only the ability to create a fork and submit a pull request to the target repository.

Blast radius

High impact as attackers can access and potentially exfiltrate multiple sensitive API keys and tokens including CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, enabling further compromise of the repository and connected services.

Detection

Monitor for unusual workflow_run events in .github/workflows/build-pr.yml that check out commits from untrusted forks, particularly those with modified setup.py or build hooks in the pr_info artifact.

Prioritized remediation

Upgrade to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 which fixes the workflow to properly validate fork commits before checking them out.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.