CVE-2026-53507: oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs
oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled — most importantly fork pull requests on public repositories — a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner. This issue has been patched in version 0.0.51.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
oasdiff-actionto a version that resolves this vulnerability.Fixed in 0.0.51 - Configuration
Set allow-external-refs to false so external $refs are not resolved/fetched when the PR spec is attacker-controlled.
GitHub Action oasdiff/actions allow-external-refs = false
Event History
Frequently Asked Questions
Which pull-request workflows are most exposed to this issue?
Workflows that run oasdiff-action on pull requests where the OpenAPI specification is attacker-controlled are exposed. The description identifies fork pull requests on public repositories as the most important case.
What must an attacker do to trigger the behavior?
The attacker needs to supply an OpenAPI specification containing an external $ref in a pull request that causes the action to run. No user interaction is required after the workflow starts.
Are default settings affected?
Yes. Before version 0.0.51, the action resolved external $refs by default because allow-external-refs was set to true.
What is the available remediation?
Update oasdiff-action to version 0.0.51, which patches the issue.