Vulnerability in Distributed Workloads Affects Snyk Integration
CVE-2026-83493

Currently unrated

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Ai (rhoai)
Vendor
CVE Published:
6 November 2026

What is CVE-2026-83493?

A security flaw in distributed workloads allows a remote attacker to exploit the pull_request_target workflow by submitting a specially crafted pull request. As this workflow processes untrusted code from the pull request author while operating with the base repository's sensitive secrets, such as SNYK_TOKEN, an attacker could potentially exfiltrate these secrets. This could lead to unauthorized access to the Snyk integration and give the attacker control over the repository, posing significant risks to the integrity and security of the project.

References

https://access.redhat.com/security/cve/CVE-2026-83493
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2526349
issue-trackingx_refsource_REDHAT

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.