Loading story…
FastGPT, an AI agent building platform, was disclosed with multiple high-severity vulnerabilities affecting both its application and development pipeline. CVE-2026-33075 impacts versions 4.14.8.3 and earlier and stems from the fastgpt-preview-image.yml GitHub Actions workflow using pull_request_target while checking out untrusted fork code. The flaw allows external contributors to achieve arbitrary code execution in GitHub Actions, exfiltrate secrets, and potentially trigger a supply-chain compromise by building and pushing attacker-controlled container images to the production registry. At disclosure, no patch was available for that issue; GitHub tracked it as GHSA-xfx8-w35j-485c.
Two additional flaws, CVE-2026-40351 and CVE-2026-40352, affect FastGPT versions prior to 4.14.9.5 and were fixed in that release. Both are NoSQL injection bugs caused by missing runtime validation in password-handling logic. The first lets an unauthenticated attacker bypass login checks by supplying MongoDB operators such as a password object matching any value, enabling login as arbitrary users including the root administrator. The second lets an authenticated low-privileged user bypass old-password verification in the password-change endpoint, enabling unauthorized password resets and possible account takeover, with broader impact if combined with ID manipulation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
GitHub security advisories published details for CVE-2026-40351 and CVE-2026-40352, describing NoSQL injection flaws in FastGPT versions prior to 4.14.9.5. The disclosures said the bugs could allow login as any user, including root, and unauthorized password changes leading to account takeover.
FastGPT released version 4.14.9.5 to fix two NoSQL injection vulnerabilities: CVE-2026-40351 in loginByPassword, which could let an unauthenticated attacker bypass authentication, and CVE-2026-40352 in updatePasswordByOld, which could let an authenticated attacker bypass old-password checks and take over accounts.
A security advisory disclosed CVE-2026-33075 affecting FastGPT 4.14.8.3 and earlier, caused by a GitHub Actions workflow using pull_request_target while checking out untrusted fork code. The flaw could enable arbitrary code execution, secret exfiltration, and potential supply-chain compromise through attacker-controlled container builds, and no patch was available at disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and maintainers disclosed multiple GitHub Actions security issues that could let attackers steal credentials or gain code execution in CI/CD pipelines. Sansec and Packagist warned that older Composer releases could print raw `GITHUB_TOKEN` values into GitHub Actions logs after rejecting GitHub’s newer hyphenated token format, creating a supply-chain risk for PHP projects, especially public repositories and older repositories where the default token still had write access. Composer issued fixes in versions `2.9.8`, `2.2.28`, and `1.10.28`, while GitHub rolled back the token format rollout to reduce immediate exposure. Separate disclosures showed how workflow design and cache handling can turn limited CI access into broader repository compromise. A newly assigned `CVE-2026-42603` affects OWASP BLT before `2.1.2`, where a privileged `pull_request_target` workflow checked out and executed code from an attacker-controlled fork, enabling remote code execution with repository write permissions. Earlier research on GitHub Actions cache poisoning described "Actions Cache Blasting," a technique that abuses client-controlled cache keys, cache eviction, and lingering runtime tokens to replace cached artifacts used by more privileged workflows, potentially leading to secret disclosure, release-signing compromise, and tampered build outputs without visible changes in source code or workflow logs.
Jun 29, 2026
Gitea disclosed two severe vulnerabilities affecting repository automation and artifact handling. **CVE-2026-58424** is a remotely exploitable authorization flaw with a CVSS score of **8.9** that can bypass permanent fork pull-request workflow approval gates, undermining branch protection and merge controls. The issue is tied to permission weaknesses including `CWE-285`, `CWE-732`, and `CWE-863`, and fixes are referenced in Gitea releases **1.26.3** and **1.26.4**. Administrators are advised to harden pull-request workflow approvals, enforce strict branch protections, and review workflow logs for signs of bypass attempts. Gitea also addressed **CVE-2026-58426**, a critical signed-URL validation flaw in **Gitea Actions Artifacts V4** with a CVSS score of **9.6**. The `CWE-347` weakness stems from HMAC ambiguity and can allow cross-repository artifact reads and cross-task upload-state writes, creating a path for unauthorized access to build artifacts and tampering with task state. The recommended response is to upgrade to a fixed Gitea release, cited as **1.26.2**, and audit artifact access controls and upload-state integrity. Separately, Canada’s Centre for Cyber Security issued an advisory urging OpenSSH users to upgrade versions prior to **10.4**, but that notice appears unrelated to the Gitea flaws.
Jul 7, 2026
A critical flaw in **Gitea `act_runner`** and a separate compromise of popular **GitHub Actions** highlighted how CI/CD platforms can be turned into high-impact attack paths. In Gitea, **`CVE-2026-58053`** allows a user with workflow execution privileges to escape a Docker-backed job container and gain **root access on the host** by abusing unsafe Docker options merged from `container.options`, including `--pid=host`, `--cap-add`, and `--security-opt`. The issue affects Docker-backed `act_runner` deployments through version `0.262.0`, putting source code, build systems, and deployment credentials at risk. In the GitHub ecosystem, attackers compromised tags for **`tj-actions/changed-files`** and several **reviewdog** actions in a supply-chain campaign tracked as **`CVE-2025-30066`** and **`CVE-2025-30154`**, causing CI/CD secrets to be written into workflow logs and potentially exposed, especially in public repositories. Reporting tied the activity to an intrusion that likely began with Coinbase-related targets before expanding more broadly. Defenders were urged to upgrade vulnerable Gitea runners, restrict workflow container options, audit workflows and logs, remove affected actions, rotate exposed secrets, preserve and then delete compromised logs, and pin GitHub Actions to full commit hashes.
Jul 7, 2026