CVE-2026-27941
EUVD-2026-880426.02.2026, 02:16
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openlit | openlit_software_development_kit | 1.36.2 ≤ 𝑥 < 1.37.1 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| openlit | openlit | 𝑥 < 1.37.1 | CNA |
Common Weakness Enumeration