PT-2026-62112 · Meltano · Hub

CVE-2026-47690 · Publicado 2026-07-21 · Atualizado 2026-07-21

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUB TOKEN with write permissions to the repository. The vulnerable workflow used pull request target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-1336

CWE-77

Identificadores relacionados

CVE-2026-47690

Produtos afetados

Hub

Referências · 7

• 🔥 https://github.com/myogahunter/meltano-hub-poc · Exploit
• https://github.com/meltano/hub/pull/2249 · Nota
• https://github.com/meltano/hub/commit/923820de8f64d753951fbbd54f7282a3d5f75173 · Nota
• https://github.com/meltano/hub/pull/2251 · Nota
• https://github.com/meltano/hub/security/advisories/GHSA-wrpf-f35c-j28w · Nota
• https://github.com/meltano/hub/pull/2247 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-47690 · Nota de Segurança