CVE-2026-47690

7.5 Élevée

Publiée le 21/07/2026 à 23:16 · Modifiée le 23/07/2026 à 18:15 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

Traduire en français

Produits concernés

meltano hub

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-77
CWE-1336

Références

https://github.com/meltano/hub/commit/923820de8f64d753951fbbd54f7282a3d5f75173
https://github.com/meltano/hub/pull/2247
https://github.com/meltano/hub/pull/2249
https://github.com/meltano/hub/pull/2251
https://github.com/meltano/hub/security/advisories/GHSA-wrpf-f35c-j28w
https://github.com/myogahunter/meltano-hub-poc

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories