CVE-2026-40903: goshs Information Disclosure Vulnerability

CVE-2026-40903 Overview

CVE-2026-40903 is an Information Leakage vulnerability affecting goshs, a SimpleHTTPServer written in Go. Prior to version 2.0.0-beta.6, goshs contains an ArtiPACKED vulnerability that can lead to the leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability allows unauthenticated remote attackers to potentially access sensitive authentication tokens.

Critical Impact

Exploitation of this vulnerability can result in unauthorized access to GitHub tokens, potentially allowing attackers to perform actions on GitHub repositories with the permissions granted to the leaked token, including code modifications, secrets access, and supply chain attacks.

Affected Products

• goshs versions prior to 2.0.0-beta.6

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-40903 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-40903

Vulnerability Analysis

This vulnerability falls under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The ArtiPACKED vulnerability in goshs allows sensitive GitHub tokens to be inadvertently exposed through workflow artifacts. When GitHub Actions workflows run, the GITHUB_TOKEN environment variable may become embedded in build artifacts that are subsequently uploaded and stored as workflow artifacts. These artifacts can potentially be accessed by unauthorized parties, leading to token leakage.

The issue is particularly concerning because the token exposure occurs through the artifact generation and upload process, not through the repository source code itself. This means that code reviews alone would not detect the presence of sensitive tokens in the generated artifacts.

Root Cause

The root cause of this vulnerability lies in improper handling of environment variables during the artifact generation process. The goshs application, when used in GitHub Actions workflows, fails to properly sanitize or exclude sensitive environment variables like GITHUB_TOKEN from being captured in workflow artifacts. This represents a failure in the inclusion of functionality from untrusted control spheres, where environment context is improperly incorporated into generated outputs.

Attack Vector

The attack vector for CVE-2026-40903 is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying repositories using vulnerable versions of goshs in their GitHub Actions workflows
2. Accessing publicly available workflow artifacts or gaining access to private artifact storage
3. Extracting the embedded GITHUB_TOKEN from the artifact contents
4. Using the leaked token to perform unauthorized actions on the repository or organization

The vulnerability allows for the compromise of confidentiality and integrity, as the leaked token can be used to read sensitive data and potentially modify repository contents depending on the token's permission scope.

Detection Methods for CVE-2026-40903

Indicators of Compromise

• Unexpected access patterns to workflow artifacts in GitHub Actions
• Unauthorized API calls using GITHUB_TOKEN credentials from unknown IP addresses
• Repository modifications or secret access events not attributable to known team members
• Anomalous token usage patterns in GitHub audit logs

Detection Strategies

• Review GitHub audit logs for suspicious token usage originating from external IP addresses
• Monitor for unexpected downloads of workflow artifacts from public or private repositories
• Implement artifact content scanning to detect embedded tokens or credentials
• Use GitHub's token scanning features to identify exposed credentials

Monitoring Recommendations

• Enable GitHub Advanced Security features for real-time secret scanning
• Configure alerts for unusual API activity using GITHUB_TOKEN authentication
• Implement logging and monitoring for all workflow artifact access events
• Review and audit CI/CD pipeline configurations regularly for token exposure risks

How to Mitigate CVE-2026-40903

Immediate Actions Required

• Upgrade goshs to version 2.0.0-beta.6 or later immediately
• Rotate all GITHUB_TOKEN secrets that may have been exposed in workflow artifacts
• Review historical workflow artifacts for potential token leakage
• Audit repository access logs for any unauthorized activity using potentially compromised tokens

Patch Information

The vulnerability is fixed in goshs version 2.0.0-beta.6. Users should update to this version or later to remediate the vulnerability. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Avoid using affected versions of goshs in GitHub Actions workflows until upgraded
• Minimize the permissions scope of GITHUB_TOKEN in workflow configurations
• Use short-lived tokens with minimal permissions where possible
• Configure workflow artifacts to expire quickly to reduce exposure window
• Implement artifact access restrictions to limit who can download workflow outputs

# Update goshs to the patched version
go install github.com/patrickhener/goshs@v2.0.0-beta.6

# Verify the installed version
goshs --version