Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-83493— Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master

Quick assessment

Affected

Red Hat Red Hat OpenShift AI (RHOAI)

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在项目中发现一个安全缺陷。远程攻击者可通过提交精心构造的拉取请求（pull request），利用工作流中的漏洞进行攻击。该工作流在处理来自拉取请求发起者的不可信代码时，会使用基础仓库的敏感凭据（例如）以及默认的写入型令牌（write token）。因此，攻击者可能窃取这些凭据，从而获得对 Snyk 集成的未授权访问权限，并可能进一步控制该仓库。

AI Predicted 9.8 Difficulty: Trivial Updated Nov 06, 2026

Possible ATT&CK Techniques 3 AI

T1078.004 · Cloud Accounts T1190 · Exploit Public-Facing Application T1552.004 · Private Keys

Updated Nov 06, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

从非可信控制范围包含功能例程

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Red Hat	Red Hat OpenShift AI (RHOAI)	-	`cpe:/a:redhat:openshift_ai`

II. Public POCs for CVE-2026-83493

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-83493

请登录查看更多情报信息。

Other References for CVE-2026-83493 (2)

https://access.redhat.com/security/cve/CVE-2026-83493 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2526349 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-83493

Same Patch Batch · Red Hat · 2026-11-06 · 15 CVEs total

CVE-2026-109081	6.8 MEDIUM	Keycloak-services: keycloak-services: injection of roles into realm default-roles via dcr
CVE-2026-19688	6.8 MEDIUM	Keycloak-services: keycloak-services: admin api missing audience check
CVE-2026-123037	6.7 MEDIUM	Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privi
CVE-2026-96547	6.5 MEDIUM	Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging
CVE-2026-97848	6.5 MEDIUM	Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sa
CVE-2026-9797	6.5 MEDIUM	Keycloak: keycloak: privilege escalation via client authentication manipulation by an auth
CVE-2026-107124	6.4 MEDIUM	Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_h
CVE-2026-97367	6.4 MEDIUM	Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account re
CVE-2026-120749	6.2 MEDIUM	Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver
CVE-2026-96460	5.4 MEDIUM	Keycloak-services: keycloak-services: indefinite access token renewal via standard token e
CVE-2026-92856	4.9 MEDIUM	Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation cons
CVE-2026-121837	4.3 MEDIUM	Quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @securefield ignored fo
CVE-2026-96447	4.2 MEDIUM	Keycloak-services: keycloak-services: stateless token preferred_username fallback enables
CVE-2026-83494		Training-operator: pytorchjob validateupdate casts oldjob from newobj, bypassing managedby

IV. Related Vulnerabilities

Same product: Red Hat OpenShift AI (RHOAI)

Same vendor: Red Hat

Same weakness: CWE-829