{"id":"CVE-2026-83493","published":"2026-11-06T07:17:52.420","lastModified":"2026-11-06T07:17:57.160","description":"A flaw was found in distributed-workloads. A remote attacker could exploit a vulnerability in the pull_request_target workflow by submitting a specially crafted pull request. This workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as the SNYK_TOKEN, and its default write token. Consequently, an attacker could exfiltrate these secrets, leading to unauthorized access to the Snyk integration and potential control over the repository.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-829"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-83493","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2526349","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}