PT-2026-62112 · Meltano · Hub

CVE-2026-47690 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUB TOKEN with write permissions to the repository. The vulnerable workflow used pull request target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-1336

CWE-77

Related Identifiers

CVE-2026-47690

Affected Products

Hub

References · 7

• 🔥 https://github.com/myogahunter/meltano-hub-poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47690 · Security Note
• https://github.com/meltano/hub/pull/2249 · Note
• https://github.com/meltano/hub/commit/923820de8f64d753951fbbd54f7282a3d5f75173 · Note
• https://github.com/meltano/hub/pull/2251 · Note
• https://github.com/meltano/hub/security/advisories/GHSA-wrpf-f35c-j28w · Note
• https://github.com/meltano/hub/pull/2247 · Note