CVE-2026-104626
Description
A flaw was found in Gitea Actions. An authenticated user capable of submitting a pull request from a repository fork can exploit this vulnerability to execute untrusted workflow code on repository runners. When a workflow job awaiting approval is canceled by a subsequent run within the same concurrency group, it remains marked as awaiting approval. If a repository maintainer subsequently approves the run, Gitea improperly reschedules the canceled job and dispatches it to a runner, executing unverified, fork-controlled code.
Statement
Red Hat product security classifies this flaw with an Important severity because successful exploitation allows authenticated attackers to execute untrusted code in CI/CD runners, but exploitation is bounded by the prerequisite of maintainer interaction. The issue occurs when previously canceled workflows in concurrency groups are revived upon subsequent manual approval. Red Hat does not ship the upstream Gitea server or its internal Actions execution engine, and related integrations such as OpenShift Pipelines are not affected as the vulnerable code is not present.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
