PT-2026-22081 · Openlist · Openlist

Nilsreichardt · CVE-2026-27941 · Published 2026-02-26 · Updated 2026-03-03

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenLIT versions prior to 1.37.1

Description OpenLIT, an open source AI engineering platform, has an issue in GitHub Actions workflows prior to version 1.37.1. These workflows use the pull request target event and execute untrusted code from forked pull requests with the security context of the base repository. This includes a write-privileged GITHUB TOKEN and access to sensitive secrets such as API keys, database/vector store tokens, and a Google Cloud service account key. The pull request target event allows execution of code from potentially malicious pull requests.

Recommendations Update OpenLIT to version 1.37.1 or later.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-27941

GHSA-9JGV-X8CQ-296Q

PYSEC-2026-2246

Affected Products

Openlist

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27941.json · Exploit
• https://github.com/openlit/openlit/security/advisories/GHSA-9jgv-x8cq-296q · Vendor Advisory
• https://github.com/openlit/openlit/commit/4a62039a1659d6cbb8913172693f587b5fc2546c · Patch
• https://osv.dev/vulnerability/PYSEC-2026-2246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27941 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27941 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2026850097984610313 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026983223218090347 · Twitter Post
• https://twitter.com/pulsepatchio/status/2027394293187350809 · Twitter Post
• https://twitter.com/CVEnew/status/2027004226891563445 · Twitter Post
• https://twitter.com/cracbot/status/2028787637486760430 · Twitter Post
• https://twitter.com/CveTodo/status/2026849264094073102 · Twitter Post