Fork-controlled build hooks run with secrets in Salty docs workflow
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-829.
Summary
The saltyorg docs repository, which builds and deploys docs.saltbox.dev, is affected before commit 649c9aea2daef1168eeb0415b44e65dbbde9f220. Its build workflow checks out fork pull request content and runs pip install on it, so code from a fork's setup.py or build hooks runs with deployment secrets (CWE-94). An unauthenticated remote attacker can open a fork pull request to disclose secrets such as CF_API_TOKEN and GH_TOKEN and gain further control.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
The Salty documentation repository builds and deploys the docs.saltbox.dev website. Prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, .github/workflows/trigger-pr-build.yml records an untrusted fork commit in the pr_info artifact, and the secret-bearing workflow_run job in .github/workflows/build-pr.yml checks out that commit before running pip install -r requirements.txt. A fork pull request can therefore supply attacker-authored setup.py or PEP 517 build hooks whose installation code executes in the privileged base-repository workflow with CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, allowing secret disclosure and follow-on compromise. The vulnerability is not caused by the repository-fork guard, and the demonstrated path requires attacker control of fork content rather than merely the artifact metadata. This vulnerability is fixed with commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| saltyorg | docs | before 649c9aea2daef1168eeb0415b44e65dbbde9f220 | 649c9aea2daef1168eeb0415b44e65dbbde9f220 | Patch available | CNA |
- docs Vendorsaltyorg Affected before 649c9aea2daef1168eeb0415b44e65dbbde9f220 Fixed in 649c9aea2daef1168eeb0415b44e65dbbde9f220 Patch available CNA
Remediation
Apply commit 649c9aea2daef1168eeb0415b44e65dbbde9f220, which fixes the docs repository.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
- Fix · CNA docs (saltyorg) Fixed in 649c9aea2daef1168eeb0415b44e65dbbde9f220
Timeline
- 2026-10-13 Threatist record created from CVE-2026-55675
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: MEDIUM → HIGH
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences