CVE-2026-53507
Received Received - Intake

oasdiff-action SSRF via External $refs Before 0.0.51

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description
oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled — most importantly fork pull requests on public repositories — a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner. This issue has been patched in version 0.0.51.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-53507
EUVD
EUVD-2026-68729

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
oasdiff oasdiff_action to 0.0.51 (exc)
oasdiff oasdiff_action 0.0.51
oasdiff oasdiff_action 1.18.1
github oasdiff_action 0.0.51

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-53507 is a vulnerability in the oasdiff GitHub Action versions 0.0.50 and earlier. It allows attackers to exploit external $refs in OpenAPI specs to perform Server-Side Request Forgery (SSRF) and disclose structured files on the runner. This happens because the action resolves external $refs by default, enabling untrusted pull requests to trigger requests to internal or external addresses without maintainer interaction.

Detection Guidance

To detect this vulnerability, check if your oasdiff-action version is 0.0.50 or earlier. Run: grep -r 'oasdiff-action' .github/workflows/ | grep version:. If the version is <=0.0.50, the system is vulnerable. Also inspect workflow logs for external $ref resolution attempts or SSRF indicators.

Impact Analysis

This vulnerability can allow attackers to force the GitHub runner to make requests to internal or external systems (SSRF) and read local files on the runner, exposing sensitive data. It is particularly risky for public repositories accepting contributions from forks, as attackers can trigger these behaviors without any interaction from maintainers.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exposure of structured files or internal system access may result in non-compliance with these regulations, potentially leading to legal and financial penalties.

Mitigation Strategies
  • Upgrade oasdiff-action to version 0.0.51 or later in all workflows.
  • Set allow-external-refs: false in .oasdiff.yaml or workflow inputs to disable external reference resolution by default.
  • Avoid running actions on untrusted pull requests from forks unless external refs are explicitly allowed.
  • Review workflows for any external $ref usage and update them to use trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53507. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart