Vulnerability in Filecoin Pin’s API Implementation Exposes Wallet to External Artifacts
CVE-2026-58412

8.2HIGH

Key Information:

Vendor: Filecoin-project
Status: Filecoin-pin
Vendor: CVE Published:; 30 October 2026

🔔 Create Filecoin-project Vulnerability Alert

What is CVE-2026-58412?

The Filecoin Pin API suffers from an improper access control vulnerability that can be exploited through a flawed workflow configuration. Specifically, prior to version 1.1.0, the upload GitHub Action does not adequately check for untrusted fork pull requests. As a result, external contributors can manipulate workflows to upload malicious artifacts using the repository owner's Filecoin wallet. This leads to unauthorized storage expenses and potential pollution of datasets without exposing the wallet's private key. A migration to the fixed version is necessary to address this issue effectively.