CVE-2026-53507: oasdiff-action GitHub SSRF Vulnerability

CVE-2026-53507 Overview

CVE-2026-53507 is a high-severity vulnerability in oasdiff-action, a GitHub Action that detects breaking changes in OpenAPI specifications and posts reviews on pull requests. Versions prior to 0.0.51 resolved external $ref values in OpenAPI documents by default, using the allow-external-refs: true setting. When the action processes an attacker-controlled specification, particularly from fork pull requests on public repositories, the runner fetches remote references and reads local files without user interaction. This behavior enables Server-Side Request Forgery (SSRF) and disclosure of structured files present on the GitHub Actions runner. The issue is patched in version 0.0.51.

Critical Impact
Attackers can trigger SSRF and exfiltrate structured files from the GitHub Actions runner by submitting a crafted OpenAPI spec through a fork pull request, with no user interaction required.

Affected Products

oasdiff-action versions prior to 0.0.51
GitHub Actions workflows running oasdiff-action on pull requests
Public repositories accepting fork pull requests that invoke the action

Discovery Timeline

2026-08-31 - CVE-2026-53507 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-53507

Vulnerability Analysis

The vulnerability stems from the action's default handling of external references in OpenAPI specifications. The oasdiff-action parses the OpenAPI document supplied by a pull request and resolves any $ref entries it encounters. Because allow-external-refs defaulted to true, the resolver followed references pointing to remote URLs and to local file paths on the runner. This behavior maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. An attacker who controls the specification controls the destination of these lookups. The action then embeds resolved content or error messages into diff output surfaced back to the pull request, providing an oracle for data disclosure.

Root Cause

The root cause is an insecure default configuration in the reference resolver. The action trusted the pull request payload as a normal build input and did not distinguish between references to the repository under review and references to arbitrary external resources or runner-local paths.

Attack Vector

An attacker forks a public repository that uses oasdiff-action and opens a pull request modifying the OpenAPI specification. The malicious spec includes a $ref pointing to an internal HTTP endpoint, a cloud metadata service, or a structured file on the runner filesystem. When the workflow runs, the action resolves the reference from the runner context. The fetched contents can then be observed through the diff comment or job logs, disclosing internal service responses and files accessible to the runner.

See the GitHub Security Advisory GHSA-fhj3-7267-7vv5 for technical details.

Detection Methods for CVE-2026-53507

Indicators of Compromise

Pull request workflow runs invoking oasdiff-action at versions below 0.0.51 on fork-originated pull requests.
OpenAPI spec files in pull requests containing $ref values pointing to external URLs, file:// paths, or local runner paths such as /etc/, /home/runner/, or /proc/.
Outbound network requests from GitHub Actions runners to unexpected hosts, internal IP ranges, or cloud metadata endpoints such as 169.254.169.254.
Diff or review comments on pull requests containing fragments of runner configuration, environment data, or non-OpenAPI file content.

Detection Strategies

Audit repository workflows for use of oasdiff-action and record the pinned version and any allow-external-refs configuration.
Parse OpenAPI files submitted in pull requests for $ref values that resolve outside the repository tree.
Correlate Actions runner egress logs with workflow execution to flag reference resolution to non-repository destinations.

Monitoring Recommendations

Ingest GitHub Actions workflow logs and audit events into a centralized analytics platform to review third-party action versions and network activity.
Alert on pull request events from forks that trigger workflows invoking third-party actions with elevated permissions or secret access.
Track dependency changes in .github/workflows/ files to detect downgrades or reintroduction of vulnerable oasdiff-action versions.

How to Mitigate CVE-2026-53507

Immediate Actions Required

Upgrade all workflows to oasdiff-action version 0.0.51 or later and pin the version by commit SHA.
Set allow-external-refs: false explicitly in any workflow that continues to use the action.
Review recent fork pull request workflow runs for suspicious $ref values or unexpected outbound requests from runners.
Rotate any secrets, tokens, or credentials that may have been present on affected runners during vulnerable executions.

Patch Information

The maintainers addressed the issue in oasdiff-action version 0.0.51. The fix changes the default behavior so external references are not resolved unless the workflow explicitly opts in. Review the changes in GitHub Pull Request #128, GitHub Pull Request #129, and GitHub Pull Request #130.

Workarounds

Restrict the action to pull_request events from the same repository and avoid running it on pull_request_target with fork content.
Remove secrets and write-scoped GITHUB_TOKEN permissions from workflows that process untrusted OpenAPI input.
Use a self-hosted or ephemeral runner with strict egress filtering to block access to internal services and cloud metadata endpoints.
Validate OpenAPI specifications in a sandboxed step that rejects $ref values resolving outside the repository before invoking the action.

bash

# Configuration example: pin patched version and disable external refs
- name: Run oasdiff
  uses: oasdiff/oasdiff-action@v0.0.51
  with:
    allow-external-refs: false