CVE-2026-73800: Gitea reusable workflow secret exposure in pull_request_target
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.
Affected Software
Event History
Frequently Asked Questions
Which repositories are exposed to this issue?
Repositories are exposed when a trusted base-branch workflow handles pull_request_target events and calls a local reusable workflow. The issue becomes exploitable when an untrusted fork can supply changes to the referenced reusable workflow.
What must an attacker be able to do to exploit it?
The attacker needs to submit a pull request from a fork and modify the local reusable workflow referenced by a base-branch workflow. When the pull_request_target workflow runs, Gitea resolves that reusable workflow from the fork head commit, allowing the modified code to run with repository and organization secrets available to the event.
Are secrets at risk in every pull request workflow?
No. The described exposure specifically requires pull_request_target, a base workflow that calls a local reusable workflow, and a fork-controlled change to that referenced workflow. Workflows without that combination are not described as affected.