CVE-2026-46699
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In the conda-smithy tool, prior to version 3.61.0, a vulnerability allowed unintended access to feedstock repositories through GitHub username takeover. The issue stemmed from using mutable GitHub usernames as identifiers for repository invitation routing.
Risk Assessment
Organizations may be exposed to unauthorized access to their repositories, potentially leading to unauthorized code changes or data leaks.
Recommendation
It is recommended to update the conda-smithy tool to version 3.61.0 or later to mitigate this vulnerability.
Original NVD description (English source)
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository invitation routing, rather than stable, immutable GitHub user IDs. Version 3.61.0 fixes the issue.