CVE-2026-83493

A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.

Referanslar

• https://access.redhat.com/security/cve/CVE-2026-83493
• https://bugzilla.redhat.com/show_bug.cgi?id=2526349