CVE-2026-27941: OpenLIT Auth Bypass Vulnerability

CVE-2026-27941 Overview

CVE-2026-27941 is a critical security vulnerability affecting OpenLIT, an open source platform for AI engineering. The vulnerability exists in several GitHub Actions workflows within OpenLIT's GitHub repository that use the pull_request_target event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged GITHUB_TOKEN and numerous sensitive secrets such as API keys, database/vector store tokens, and a Google Cloud service account key. This misconfiguration allows malicious actors to potentially exfiltrate sensitive credentials and compromise the entire CI/CD pipeline.

Critical Impact

Attackers can exploit this vulnerability to steal sensitive secrets including API keys, database credentials, vector store tokens, and Google Cloud service account keys by submitting malicious pull requests from forked repositories.

Affected Products

• OpenLIT versions prior to 1.37.1
• OpenLIT GitHub Actions CI/CD workflows using pull_request_target event
• Any fork-based contribution workflow in affected OpenLIT repositories

Discovery Timeline

• February 26, 2026 - CVE CVE-2026-27941 published to NVD
• February 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-27941

Vulnerability Analysis

This vulnerability falls under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The core issue stems from the dangerous combination of the pull_request_target event trigger with actions that check out and execute code from the pull request's head branch.

In GitHub Actions, the pull_request_target event is designed to run workflows in the context of the base repository rather than the forked repository. While this is useful for accessing secrets needed to comment on PRs or update labels, it becomes dangerous when the workflow checks out code from the untrusted fork and executes it. This effectively grants the forked code access to all secrets and write permissions configured in the base repository.

The affected workflows in OpenLIT were exposing highly sensitive credentials including API keys for external services, database and vector store authentication tokens, and Google Cloud service account keys that could provide broad cloud infrastructure access.

Root Cause

The root cause is an insecure GitHub Actions workflow configuration that violates the principle of least privilege. The workflows were configured to:

1. Trigger on pull_request_target events from forks
2. Check out code from the pull request's head branch (the forked repository)
3. Execute build, test, or other scripts from this untrusted code
4. Run with full access to repository secrets and a write-privileged GITHUB_TOKEN

This design pattern allows any user who can open a pull request to execute arbitrary code with the privileges of the target repository's CI/CD environment.

Attack Vector

The attack vector is network-based and requires low privileges—an attacker only needs a GitHub account capable of forking the repository. The exploitation process involves:

1. An attacker forks the vulnerable OpenLIT repository
2. The attacker modifies workflow scripts, build files, or test scripts in their fork to exfiltrate secrets
3. The attacker opens a pull request from their fork to the main repository
4. The pull_request_target workflow triggers and checks out the attacker's malicious code
5. The malicious code executes with access to all repository secrets
6. Secrets are exfiltrated to an attacker-controlled server

The vulnerability is particularly severe because it affects the CI/CD pipeline, which often has elevated privileges and access to production credentials. Once secrets are compromised, attackers can pivot to connected systems, cloud infrastructure, or databases.

Detection Methods for CVE-2026-27941

Indicators of Compromise

• Unexpected outbound network connections from GitHub Actions runners to unknown endpoints
• Unusual pull requests from unknown forks that modify workflow files, build scripts, or test configurations
• Audit logs showing secret access patterns that don't align with normal CI/CD operations
• Failed or suspicious authentication attempts using compromised API keys or service account credentials

Detection Strategies

• Review GitHub Actions workflow run logs for any pull requests from external contributors
• Audit repository secrets access patterns through GitHub's audit log functionality
• Monitor for unauthorized use of Google Cloud service account credentials
• Implement GitHub's secret scanning and push protection features
• Set up alerts for new workflow files or modifications to existing .github/workflows/ directory

Monitoring Recommendations

• Enable GitHub Advanced Security features including secret scanning
• Configure alerts for any modifications to workflow files in pull requests
• Monitor cloud provider audit logs (especially Google Cloud) for service account key usage from unexpected sources
• Implement network monitoring for GitHub Actions self-hosted runners if applicable
• Review GitHub audit logs for workflow_run events triggered by external contributors

How to Mitigate CVE-2026-27941

Immediate Actions Required

• Upgrade OpenLIT to version 1.37.1 or later immediately
• Rotate all secrets that were potentially exposed, including API keys, database tokens, and Google Cloud service account keys
• Review GitHub Actions run history for any suspicious activity from forked pull requests
• Audit cloud infrastructure for any unauthorized access using potentially compromised credentials

Patch Information

OpenLIT has released version 1.37.1 which contains the security fix for this vulnerability. The fix is available in commit 4a62039a1659d6cbb8913172693f587b5fc2546c.

Organizations using OpenLIT should:

1. Update to version 1.37.1 or later
2. Review the GitHub Security Advisory GHSA-9jgv-x8cq-296q for additional guidance

Workarounds

• Avoid using pull_request_target with checkout of the PR head branch in workflows
• If pull_request_target must be used, ensure no untrusted code from the fork is executed
• Use pull_request event instead where secrets are not required, as it runs in the forked repository's context
• Implement workflow approval requirements for first-time contributors using GitHub's environment protection rules
• Consider using ephemeral secrets or just-in-time credential provisioning to limit exposure windows

# Review workflow files for dangerous patterns
# Search for pull_request_target usage in your workflows
grep -r "pull_request_target" .github/workflows/

# Check if any workflow checks out PR head when using pull_request_target
# This combination is dangerous and should be avoided
grep -A 20 "pull_request_target" .github/workflows/*.yml | grep -E "(checkout|ref:.*head)"