Red Hat OpenShift AI workflow leaks repository secrets via pull requests
An AI platform's repository keys could be stolen by outsiders!
Summary
A GitHub workflow in distributed-workloads runs untrusted pull request code with the repository's secrets, such as SNYK_TOKEN. An attacker can steal these secrets and gain control over the repository.
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen