GHSL-2026-208: External pull requests can steal kpt’s SonarCloud token

Published Oct 22, 2026

Updated

kpt's privileged SonarCloud workflow uses pull request-controlled scanner configuration, allowing external contributors to redirect and steal the SonarCloud token.

Affected Software

1 affected component

kpt kpt

Event History

Oct 22, 2026

Advisory Published

via GitHub Security Lab·12:00 AM

Data Sourced

via GitHub Security Lab·12:00 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An external contributor who can open a pull request can supply scanner configuration controlled by that pull request and use it to redirect the privileged workflow’s SonarCloud token.

What credential is at risk?

The SonarCloud token available to kpt’s privileged SonarCloud workflow may be exposed to an external pull request author.

GHSL-2026-208: External pull requests can steal kpt’s SonarCloud token

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What credential is at risk?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What credential is at risk?