p PatchFirst

CVE-2026-27941

CVE-2026-27941 · OpenLIT Vulnerable to Remote Code Execution and Secret Exposure via Misuse of `pull_request_target` in GitHub Actions Workflows

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

CVSS 10.0 · Critical · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • openlit

    Versions
    • < 1.37.1: Affected

    No fix published

  • openlit PyPI

    Versions
    • 1.36.2
    • 1.36.3
    • 1.36.6
    • 1.36.7
    • 1.36.8
    • 1.36.9
    • 1.37.0
    Affected ranges
    • ECOSYSTEM: ≥ 1.36.2, < 1.37.1

    Update to 1.37.1

Original sources

Check your server →