CVE-2026-54160
Description
A flaw was found in Network UPS Tools (NUT). The project's automated workflow improperly runs untrusted code submitted in pull requests within an environment that holds elevated write privileges. A remote attacker can exploit this flaw by submitting a malicious pull request to achieve arbitrary code execution and extract a privileged access token. This access can then be used to manipulate repository contents and build statuses.
Statement
This vulnerability is rated as having an Important impact because unauthorized actors could compromise repository infrastructure and alter release artifacts via elevated continuous integration tokens. The issue is confined exclusively to upstream GitHub Actions build automation workflows and does not exist in the source code or runtime binaries of Network UPS Tools. Consequently, deployed Red Hat systems and supported packages do not execute these CI pipelines and remain unaffected during standard operation.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
