Severity
| CVSSv3.1 | 9.8 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Vendor
CloudFoundry Foundation
Versions Affected
The Cloud Foundry build infrastructure was affected. The Cloud Foundry product is not affected.
Description
GitHub Actions workflows were configured to trigger on pull_request_target while having access to repository secrets — a dangerous combination that extends to pull requests opened from forks.
The workflows check out the head commit of the pull request and execute make targets from that code. Because pull_request_target runs in the context of the base repository (granting access to secrets), but the checked-out code originates from the fork, this creates a privilege escalation path: any GitHub user can submit a pull request from a fork, supply arbitrary make target logic in their commit, and have it executed on the CI runner with full access to the repository’s secrets.
Mitigation
The vulnerability was already patched by the Cloud Foundry Team. No action is required from Cloud Foundry consumers.
Credit
This issue was responsibly reported by Dylan Guerville.
History
Sep 22 2026: Initial vulnerability report published.
