CVE-2026-116289
Description
A flaw was found in Gitea. An authenticated attacker holding a personal access token restricted to public resources can register an organization-level Actions runner because Gitea fails to validate the token's scope properly. This issue allows the runner to receive and execute automated jobs from private repositories within the organization, leading to the unauthorized disclosure of private workflow definitions, environment secrets, and repository access tokens.
Statement
This vulnerability is rated as Moderate severity because exploitation requires an attacker to already possess a scoped personal access token with organization-level administrative privileges, limiting the blast radius to permissions already held by that account. Red Hat OpenShift Pipelines and Konflux consume Gitea client libraries for source repository integration and do not host or expose the vulnerable Actions runner registration service. Consequently, direct exposure in standard Red Hat deployments is minimal.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
