CVE-2026-27941 - Vulnerability Analysis

Overview

OpenLIT prior to 1.37.1 contains a broken access control vulnerability caused by use of `pull_request_target` event in GitHub Actions workflows executing untrusted code with base repository privileges, letting attackers access sensitive secrets, exploit requires untrusted forked pull requests.

Severity & Score

Impact

Attackers can access sensitive secrets and tokens, potentially leading to full repository compromise and unauthorized actions.

Mitigation

Update to version 1.37.1 or later.

References

• https://github.com/openlit/openlit/commit/4a62039a1659d6cbb8913172693f587b5fc2546c
• https://github.com/openlit/openlit/security/advisories/GHSA-9jgv-x8cq-296q

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 26, 2026

🔴 CVE-2026-27941 - Critical (9.9) OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull re... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27941/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner