CVE-2026-58416

HighCVSS 7.1

Published: 13/08/2026(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

The vulnerability in Fork-PR Actions tasks allows reading a third private repository via the collaborative-owner branch. A missing fork-PR guard enables this.

Risk Assessment

Risk of leaking confidential data from private repositories, potentially leading to intellectual property or customer data breaches.

Recommendation

Update the software to a patched version and restrict Actions permissions for forks.

Original NVD description (English source)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)