[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz1i7eub5q8MoPOpqWf4S-dKnfWiul_qMF9yoeNjGVgo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"8538e33d-cea6-4e09-823c-dbc3a993d9a0","github-patches-pwn-request-flaw-in-actionscheckout-to-protect-cicd-pipelines","fb2fdfe9-8406-424e-b7f7-aec8518ed26e","GitHub Patches 'Pwn Request' Flaw in actions\u002Fcheckout to Protect CI\u002FCD Pipelines","The 'pwn request' attack exploits the `pull_request_target` workflow trigger, which runs with elevated repository privileges even when the code originates from an untrusted fork — creating a dangerous trust boundary violation in CI\u002FCD pipelines. Attackers can leverage this to execute arbitrary code with access to repository secrets and the GITHUB_TOKEN, effectively compromising the entire software supply chain. This matters because CI\u002FCD pipelines have become high-value targets: a single compromised workflow can lead to secret exfiltration, malicious code injection into builds, or full repository takeover. GitHub's June 2026 update enforces safer defaults, but organizations relying on custom workflows must audit their own configurations proactively rather than waiting for the deadline.","**Immediate actions:**\n- Audit all workflows using `pull_request_target` to ensure they do not checkout or execute untrusted fork code with elevated privileges.\n- Rotate any repository secrets or tokens that may have been exposed through vulnerable `pull_request_target` workflows.\n- Pin `actions\u002Fcheckout` and all third-party GitHub Actions to specific commit SHAs rather than mutable tags to prevent unexpected behavior changes.\n\n**Long-term improvements:**\n- Enforce the principle of least privilege for all CI\u002FCD workflows by scoping `GITHUB_TOKEN` permissions to the minimum required.\n- Implement branch protection rules and required code reviews before any workflow changes can be merged into the default branch.\n- Adopt a GitHub Actions security scanning tool (e.g., Semgrep, Actionlint, or StepSecurity) to continuously detect insecure workflow patterns.\n\n**Detection measures:**\n- Enable GitHub's secret scanning and push protection features to alert on accidental exposure of tokens or credentials in workflow files.\n- Monitor workflow run logs for unexpected external network calls or anomalous secret access patterns.\n- Subscribe to GitHub Security Advisories and the GitHub Changelog to receive timely notification of upcoming security-impacting changes to Actions.",[12,13,14,15,16,17,18,19,20],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-204C: CI\u002FCD Pipeline Security Guidance","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SSDF (SP 800-218) PO.5: Implement and Maintain Secure Environments for Software Development","SLSA Supply Chain Levels for Software Artifacts — Build L2\u002FL3 requirements","OWASP CI\u002FCD Security Top 10: CICD-SEC-4 (Poisoned Pipeline Execution)",{},"published","2026-06-23T16:21:28.15121+00:00","2026-06-23T16:21:27.824+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fgithub-updates-actionscheckout-to-block.html","github-updates-actions-checkout-to-block-common-pwn-request-attack-patterns-a790ae","GitHub Updates actions\u002Fcheckout to Block Common Pwn Request Attack Patterns",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":37,"name":38,"slug":39,"description":40,"color":41},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[50,54,58],{"slug":51,"name":52,"problem":53},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":55,"name":56,"problem":57},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":59,"name":60,"problem":61},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]