GitHub Actions flaws exposed repositories to token leaks and privileged workflow compromise

Researchers and maintainers disclosed multiple GitHub Actions security issues that could let attackers steal credentials or gain code execution in CI/CD pipelines. Sansec and Packagist warned that older Composer releases could print raw GITHUB_TOKEN values into GitHub Actions logs after rejecting GitHub’s newer hyphenated token format, creating a supply-chain risk for PHP projects, especially public repositories and older repositories where the default token still had write access. Composer issued fixes in versions 2.9.8, 2.2.28, and 1.10.28, while GitHub rolled back the token format rollout to reduce immediate exposure.

Separate disclosures showed how workflow design and cache handling can turn limited CI access into broader repository compromise. A newly assigned CVE-2026-42603 affects OWASP BLT before 2.1.2, where a privileged pull_request_target workflow checked out and executed code from an attacker-controlled fork, enabling remote code execution with repository write permissions. Earlier research on GitHub Actions cache poisoning described "Actions Cache Blasting," a technique that abuses client-controlled cache keys, cache eviction, and lingering runtime tokens to replace cached artifacts used by more privileged workflows, potentially leading to secret disclosure, release-signing compromise, and tampered build outputs without visible changes in source code or workflow logs.