Description
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was mis-structured in terms of mixing code running with higher privileges (single-use token generated with write permissions) and untrusted inputs (PR source branch). A malicious PR run from a fork could extract the GITHUB_TOKEN value. It could potentially be abused while it was valid (while the GHA job ran) to manipulate Git repository contents, commit checks/statuses, or issue/PR comments, according to permissions it was issued with. This issue has been patched via commits 658b24e and 1aa31d1.
Published: 2026-09-28
Score: 8.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Write-Access Exploitation
Action: Patch Immediately
AI Analysis

Impact

The vulnerability arises from a mis‑structured GitHub Actions workflow that mixes privileged code, executing with a write‑scoped GITHUB_TOKEN, and untrusted inputs—the source branch of a pull request. A malicious PR from a fork can cause the action to read the token and use it to modify the repository, alter commit checks or status updates, and add PR comments. This account or resource hijacking flaw is classified as CWE‑829.

Affected Systems

The affected systems are the Network UPS Tools (nut) repository. Any instance of the project that uses the GitHub Actions script before commits 658b24e and 1aa31d1 is vulnerable. No specific product version list is provided, so all unpatched releases that rely on this workflow are at risk.

Risk and Exploitability

The CVSS score of 8.2 indicates a high severity flaw. EPSS is not available, and it has not been listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker submitting a pull request from a fork and triggering the GitHub Actions workflow. During the job’s execution the write‑scoped token can be exploited to alter repository content, status checks, or PR comments, potentially bypassing code review and causing misconfiguration or service disruption.

Generated by OpenCVE AI on September 28, 2026 at 17:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patched commits 658b24e and 1aa31d1 or upgrade to a release that includes the fix
  • Revoke and rotate any compromised GITHUB_TOKENs used by the workflow
  • Configure the GitHub Actions workflow to run with least privilege, using a read‑only token or limiting write permissions to trusted branches

Generated by OpenCVE AI on September 28, 2026 at 17:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 28 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Networkupstools
Networkupstools nut
Vendors & Products Networkupstools
Networkupstools nut

Mon, 28 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was mis-structured in terms of mixing code running with higher privileges (single-use token generated with write permissions) and untrusted inputs (PR source branch). A malicious PR run from a fork could extract the GITHUB_TOKEN value. It could potentially be abused while it was valid (while the GHA job ran) to manipulate Git repository contents, commit checks/statuses, or issue/PR comments, according to permissions it was issued with. This issue has been patched via commits 658b24e and 1aa31d1.
Title Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB_TOKEN
Weaknesses CWE-829
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L'}

Subscriptions

Networkupstools Nut
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-28T17:23:37.046Z

Reserved: 2026-06-11T21:46:52.380Z

Link: CVE-2026-54160

cve-icon Vulnrichment

Updated: 2026-09-28T17:22:06.621Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-28T17:17:49.833

Modified: 2026-09-30T19:56:45.443

Link: CVE-2026-54160

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T17:45:04Z

Weaknesses
  • CWE-829

    Inclusion of Functionality from Untrusted Control Sphere