CVE-2026-47690

Received Received - Intake

GitHub Token Exposure in MeltanoHub Workflow

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-47690

Affected Vendors & Products

Vendor	Product	Version / Range
meltano	meltano	to 923820de8f64d753951fbbd54f7282a3d5f75173 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-1336	The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

Executive Summary

MeltanoHub versions before commit 923820de8f64d753951fbbd54f7282a3d5f75173 had a flaw in their GitHub Actions workflow using pull_request_target. This allowed attackers to exfiltrate a GITHUB_TOKEN with write permissions to the repository. The token could be accessed by malicious pull requests due to the workflow running in the base repository's context.

Detection Guidance

This vulnerability is specific to GitHub Actions workflows using pull_request_target in the MeltanoHub repository. To detect it, check GitHub Actions workflow files for use of pull_request_target with access to secrets like GITHUB_TOKEN. Look for workflows in the .github/workflows directory of the repository.

Impact Analysis

An attacker could gain write access to the MeltanoHub repository by exploiting this flaw. This could lead to unauthorized code changes, malicious plugin additions, or repository takeover. The impact includes potential supply chain attacks affecting users of Meltano plugins.

Mitigation Strategies

Update the MeltanoHub repository to commit 923820de8f64d753951fbbd54f7282a3d5f75173 or later. Review and modify any GitHub Actions workflows using pull_request_target to avoid granting write access to secrets. Replace pull_request_target with pull_request if possible.

Hi! I’m here to help you understand CVE-2026-47690. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70