Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-55675: saltyorg/docs documentation workflow can leak deployment secrets
CVE-2026-55675 · published today
Summary
The documentation build process for the Salty website runs code from external contributors before installing required packages. If a malicious contributor adds specially crafted setup files, they can cause that code to run with the repository’s secret keys, exposing them to attackers. Updating the workflow to the latest commit fixes the issue; apply the update as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| saltyorg | docs | < 649c9aea2daef1168eeb0415b44e65dbbde9f220 |
Original advisory text
Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
References
- https://github.com/saltyorg/docs/security/advisories/GHSA-wr2h-fpxm-ff4x x_refsource_CONFIRM
- https://github.com/saltyorg/docs/commit/649c9aea2daef1168eeb0415b44e65dbbde9f220 x_refsource_MISC
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-94Code Injection
CWE-829Inclusion of Functionality from Untrusted Control Sphere
CWE-1357Reliance on Insufficiently Trustworthy Component
Timeline
Published13 Oct 2026
Updated13 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta