CVSS 3.1
9.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVE-2026-27941
Critical (9.9) in openlit openlit software development kit. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in openlit 1.37.1.
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
- CWE
- CWE-829
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openlit:openlit_software_development_kit
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| PYSEC-2026-2246 | PyPI | openlit | >=1.36.2 <1.37.1 | 1.37.1 |