canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated—causing part of the GITHUB_TOKEN to be displayed in plaintext in the GitHub Actions logs. Anyone with read access to the GitHub repository can view GitHub Actions logs. For public repositories, anyone can view the GitHub Actions logs. The opportunity to exploit this vulnerability is limited—the GITHUB_TOKEN is automatically revoked when the job completes. However, there is an opportunity for an attack in the time between the GITHUB_TOKEN being displayed in the logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1.0.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | get-workflow-version-action | before 1.0.1 | 1.0.1 | Patch available | CNA |
| — | canonical/get-workflow-version-action (GitHub Actions) | before 1.0.1 | 1.0.1 | Patch available | GHSA-26wh-cc3r-w6pj |
- get-workflow-version-action VendorCanonical Affected before 1.0.1 Fixed in 1.0.1 Patch available CNA
- canonical/get-workflow-version-action (GitHub Actions) Vendor— Affected before 1.0.1 Fixed in 1.0.1 Patch available GHSA-26wh-cc3r-w6pj
Remediation
- Fix · CNA get-workflow-version-action (canonical) Fixed in 1.0.1
- Fix · GHSA-26wh-cc3r-w6pj canonical/get-workflow-version-action (GitHub Actions) Fixed in 1.0.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-31479
- 2026-10-03 Alias added: GHSA-26wh-cc3r-w6pj
References
Other 4
- https://github.com/canonical/get-workflow-version-action/security/advisories/GHSA-26wh-cc3r-w6pj
- https://github.com/canonical/get-workflow-version-action/issues/2
- https://github.com/canonical/get-workflow-version-action/commit/88281a62e96e1c0ef4df30352ae0668a9f3e3369
- https://github.com/canonical/get-workflow-version-action
More Canonical vulnerabilities
- TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-31479 · CVE Program
- CVE-2025-31479 · NVD
- FIRST EPSS
- GHSA-26wh-cc3r-w6pj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences