CVE-2026-27941: OpenLIT Auth Bypass Vulnerability

CVE-2026-27941 Overview

CVE-2026-27941 is a critical security vulnerability affecting OpenLIT, an open source platform for AI engineering. The vulnerability exists in several GitHub Actions workflows within OpenLIT's GitHub repository that use the pull_request_target event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged GITHUB_TOKEN and numerous sensitive secrets such as API keys, database/vector store tokens, and a Google Cloud service account key. This misconfiguration allows malicious actors to potentially exfiltrate sensitive credentials and compromise the entire CI/CD pipeline.

Critical Impact
Attackers can exploit this vulnerability to steal sensitive secrets including API keys, database credentials, vector store tokens, and Google Cloud service account keys by submitting malicious pull requests from forked repositories.

Affected Products

OpenLIT versions prior to 1.37.1
OpenLIT GitHub Actions CI/CD workflows using pull_request_target event
Any fork-based contribution workflow in affected OpenLIT repositories

Discovery Timeline

February 26, 2026 - CVE CVE-2026-27941 published to NVD
February 26, 2026 - Last updated in NVD database

Technical Details for CVE-2026-27941

Vulnerability Analysis

This vulnerability falls under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The core issue stems from the dangerous combination of the pull_request_target event trigger with actions that check out and execute code from the pull request's head branch.

In GitHub Actions, the pull_request_target event is designed to run workflows in the context of the base repository rather than the forked repository. While this is useful for accessing secrets needed to comment on PRs or update labels, it becomes dangerous when the workflow checks out code from the untrusted fork and executes it. This effectively grants the forked code access to all secrets and write permissions configured in the base repository.

The affected workflows in OpenLIT were exposing highly sensitive credentials including API keys for external services, database and vector store authentication tokens, and Google Cloud service account keys that could provide broad cloud infrastructure access.

Root Cause

The root cause is an insecure GitHub Actions workflow configuration that violates the principle of least privilege. The workflows were configured to:

Trigger on pull_request_target events from forks
Check out code from the pull request's head branch (the forked repository)
Execute build, test, or other scripts from this untrusted code
Run with full access to repository secrets and a write-privileged GITHUB_TOKEN

This design pattern allows any user who can open a pull request to execute arbitrary code with the privileges of the target repository's CI/CD environment.

Attack Vector

The attack vector is network-based and requires low privileges—an attacker only needs a GitHub account capable of forking the repository. The exploitation process involves:

An attacker forks the vulnerable OpenLIT repository
The attacker modifies workflow scripts, build files, or test scripts in their fork to exfiltrate secrets
The attacker opens a pull request from their fork to the main repository
The pull_request_target workflow triggers and checks out the attacker's malicious code
The malicious code executes with access to all repository secrets
Secrets are exfiltrated to an attacker-controlled server

The vulnerability is particularly severe because it affects the CI/CD pipeline, which often has elevated privileges and access to production credentials. Once secrets are compromised, attackers can pivot to connected systems, cloud infrastructure, or databases.

Detection Methods for CVE-2026-27941

Indicators of Compromise

Unexpected outbound network connections from GitHub Actions runners to unknown endpoints
Unusual pull requests from unknown forks that modify workflow files, build scripts, or test configurations
Audit logs showing secret access patterns that don't align with normal CI/CD operations
Failed or suspicious authentication attempts using compromised API keys or service account credentials

Detection Strategies

Review GitHub Actions workflow run logs for any pull requests from external contributors
Audit repository secrets access patterns through GitHub's audit log functionality
Monitor for unauthorized use of Google Cloud service account credentials
Implement GitHub's secret scanning and push protection features
Set up alerts for new workflow files or modifications to existing .github/workflows/ directory

Monitoring Recommendations

Enable GitHub Advanced Security features including secret scanning
Configure alerts for any modifications to workflow files in pull requests
Monitor cloud provider audit logs (especially Google Cloud) for service account key usage from unexpected sources
Implement network monitoring for GitHub Actions self-hosted runners if applicable
Review GitHub audit logs for workflow_run events triggered by external contributors

How to Mitigate CVE-2026-27941

Immediate Actions Required

Upgrade OpenLIT to version 1.37.1 or later immediately
Rotate all secrets that were potentially exposed, including API keys, database tokens, and Google Cloud service account keys
Review GitHub Actions run history for any suspicious activity from forked pull requests
Audit cloud infrastructure for any unauthorized access using potentially compromised credentials

Patch Information

OpenLIT has released version 1.37.1 which contains the security fix for this vulnerability. The fix is available in commit 4a62039a1659d6cbb8913172693f587b5fc2546c.

Organizations using OpenLIT should:

Update to version 1.37.1 or later
Review the GitHub Security Advisory GHSA-9jgv-x8cq-296q for additional guidance

Workarounds

Avoid using pull_request_target with checkout of the PR head branch in workflows
If pull_request_target must be used, ensure no untrusted code from the fork is executed
Use pull_request event instead where secrets are not required, as it runs in the forked repository's context
Implement workflow approval requirements for first-time contributors using GitHub's environment protection rules
Consider using ephemeral secrets or just-in-time credential provisioning to limit exposure windows

bash

# Review workflow files for dangerous patterns
# Search for pull_request_target usage in your workflows
grep -r "pull_request_target" .github/workflows/

# Check if any workflow checks out PR head when using pull_request_target
# This combination is dangerous and should be avoided
grep -A 20 "pull_request_target" .github/workflows/*.yml | grep -E "(checkout|ref:.*head)"