GHSL-2026-191: TOCTOU in the MongoDB JS Kerberos release notes workflow
The releasenotes workflow checks out a mutable pull request ref after a maintainer authorizes a run. An external contributor can exploit this race condition to execute code with a write-scoped GITHUBTOKEN.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Repositories using the affected release_notes workflow are exposed when they accept pull requests from external contributors and a maintainer authorizes a workflow run for one of those pull requests.
What does an attacker need to exploit it?
An attacker needs to be an external contributor with a pull request and must win the race by changing the mutable pull request ref after a maintainer authorizes the run. Successful exploitation executes attacker-controlled code with a write-scoped GITHUB_TOKEN.
How can teams tell whether they are affected?
Review the release_notes workflow for a checkout of a mutable pull request ref that occurs after maintainer authorization and runs with a write-scoped GITHUB_TOKEN. The provided information does not identify affected versions or a fixed revision.