CVE-2026-31852 - Vulnerability Analysis

Overview

Jellyfin jellyfin-ios contains an arbitrary code execution vulnerability in the code-quality.yml GitHub Actions workflow due to elevated permissions, letting attackers via forked pull requests fully compromise the repository and organization, exploit requires pull request from forked repository.

Severity & Score

Impact

Attackers can fully compromise the repository, exfiltrate secrets, poison packages, and compromise the entire organization.

Mitigation

No update required; end users do not need to take any actions as this is a workflow configuration issue.

References

• https://github.com/jellyfin/jellyfin-ios/commit/109217e75f38394b2f6e46e25dfe5a721203d3c8
• https://github.com/jellyfin/jellyfin-ios/security/advisories/GHSA-7qhm-2m45-7fmh

Social Media Activity(1 post)

Taggart

@mttaggart

Mar 16, 2026

This was a misconfiguration in Jellyfin's GitHub Actions. It has since been fixed. I'm kinda struggling to call this a "software vulnerability." Like...GitHub worked fine. The user (jellyfin) made insecure choices. This makes less sense than the rPi default credentials. https://nvd.nist.gov/vuln/detail/CVE-2026-31852

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner