JFrog RepoHunter Uncovers 13 CI/CD pull_request_target 'Pwn Request' Vulnerabilities Across Ansible, QGIS, Eclipse Theia, Typst, SDKMAN, Telepresence, Tencent, Ceph & More (CVE-2026-24480, CVE-2026-1699) — Threadlinqs Intelligence
As of 2026-03-05, JFrog RepoHunter Uncovers 13 CI/CD pull_request_target 'Pwn Request' Vulnerabilities Across Ansible, QGIS, Eclipse Theia, Typst, SDKMAN, Telepresence, Tencent, Ceph & More (CVE-2026-24480, CVE-2026-1699) is a critical-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1535 · Severity: CRITICAL · CVSS: 8.8 · Status: ACTIVE · Category: SUPPLY_CHAIN
JFrog's AI-driven security research tool RepoHunter (built by Barak Haryati) discovered 13 critical/high/medium CI/CD workflow vulnerabilities (10 Critical, 2 High, 1 Medium) across major open-source
JFrog's Senior Director of Product Security, Barak Haryati, built RepoHunter, an AI-driven security research bot that automatically crawls open-source GitHub repositories, statically analyzes GitHub Actions workflow configurations, identifies patterns where untrusted external input (pull request branch names, file contents, commit messages, PR titles) reaches privileged execution contexts, and validates exploitability using AI-generated proof-of-concept scenarios. Over a multi-month campaign, RepoHunter surfaced 13 confirmed critical CI/CD takeover vulnerabilities in high-profile OSS projects: Ansible (ansible.platform, GHSA-fwqj-x86q-prmq), P4 Language (GHSA-6cw7-hxfh-8x94), Petgraph, QGIS (CVE-2026-24480 / GHSA-7h99-4f97-h6rw), SDKMAN (GHSA-cprm-c872-3fw7), tc39/proposal-amount (GHSA-43vf-c68r-43mr), Telepresence/CNCF (GHSA-gc3r-m7gq-495f), Typst (GHSA-j5gp-pf74-5pj6), Xorbitsai, Eclipse Theia Website (CVE-2026-1699), Tencent (GHSA-c44p-qr97-jccv), Ceph (GHSA-p433-fp4g-pc2c), and Parse-community (GHSA-6w8g-mgvv-3fcj).
The unifying root cause is the GitHub Actions 'pwn request' anti-pattern: a workflow triggers on pull_request_target (which runs in the base repository's security context, with full access to repository secrets and a GITHUB_TOKEN scoped to the base repo) but then explicitly checks out and executes the pull request's HEAD commit -- code fully controlled by the PR author, who may be an untrusted, first-time external contributor. This differs from the safer pull_request trigger, which runs in a sandboxed fork context with a read-only, minimally-scoped token.
Three distinct execution primitives were observed across the 13 findings: (1) test-based execution, where PR-supplied test files (Rust .rs files in Typst, npm test scripts in Theia) are executed directly by the CI test runner; (2) build-script execution, where PR-controlled build tooling (a modified gradlew wrapper in SDKMAN, npm install/build in Theia, Makefile targets in Telepresence, cargo in Petgraph) runs attacker-supplied commands during the normal build process; and (3) config/branch injection, where unsanitized metadata such as branch names or a malicious .pre-commit-config.yaml (QGIS) is interpolated into shell commands or hook definitions, yielding command injection.
A compounding factor documented across multiple advisories is actions/checkout's historical default of persist-credentials: true, which writes the ephemeral GITHUB_TOKEN into .git/config inside the runner workspace -- meaning any RCE primitive, however achieved, can trivially read the token back out of the git configuration file rather than needing to specifically target environment variables. GitHub subsequently changed the safer defaults for pull_request_target checkouts in its June 2026 Actions checkout update in direct response to this vulnerability class.
Per-project impact: Ansible's ansible.platform workflow exposed both a highly-privileged GITHUB_TOKEN (contents:write, actions:write, packages:write, pull-requests:write, deployments:write, attestations:write, pages:write) and a custom AAP_GATEWAY_REPO_TOKEN enabling lateral movement into other Ansible Automation Platform repositories, risking millions of downstream package downloads. QGIS's 'pre-commit checks' workflow allowed an attacker to add a malicious .pre-commit-config.yaml defining an arbitrary-execution hook, achieving RCE with a write-scoped GITHUB_TOKEN able to push commits, modify branches, and tamper with QGIS release artifacts consumed by governments, research institutions, and Linux distribution packagers. Eclipse Theia's Website repository preview.yml workflow exposed GITHUB_TOKEN plus DEPLOY_PREVIEW_TOKEN and NODE_AUTH_TOKEN, enabling secret exfiltration, malicious npm package publication under the eclipse-theia organization, and direct modification of the official Theia website. Typst's test_pr.yml exposed AZURE_PACKAGE_CREDENTIALS, GH_PRIVATE_KEY, GH_APP_ID, and GH_INSTALLATION_ID -- a GitHub App private key
Weaknesses (CWE)
CWE-829, CWE-78, CWE-94, CWE-284
Target sectors: technology, government administration, critical-infrastructure, open-source-ecosystem, software-supply-chain, research-and-education
Target regions: Global
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, CVE-2026-24480, CVE-2026-1699, T1593, T1585, T1199, T1195, T1059, T1053, T1195, T1078, T1036, T1140