CVE-2026-58412：Filecoin Pin 受 GitHub Actions Fork Bypass 攻擊，導致未授權儲存
CVE-2026-58412 - Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow
Filecoin Pin 的 GitHub Actions 工作流程在 1.1.0 之前存在 fork bypass 漏洞，攻擊者可利用倉庫所有者的 Filecoin wallet 上傳惡意 artifact，導致未授權儲存與額外費用。
此漏洞使攻擊者能利用倉庫所有者的 Filecoin 錢包進行未授權儲存，造成額外費用與資料汙染，且不需洩露私鑰，提醒使用者及時升級至 1.1.0 以防止資金被盜，並建議檢查 GitHub Actions 工作流程配置，避免未授權的 fork PR 觸發。
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in `upload-action/src/build.js` checks only `event.pull_request`. In the documented two-workflow pattern, an untrusted fork pull-request workflow produces an artifact and a privileged `workflow_run` workflow downloads and uploads it. Because `workflow_run` has no `event.pull_request`, `isForkPR` becomes false and `uploadStatus` becomes `pending-upload`. The action later resolves `workflow_run.pull_requests` without repeating the fork check before initializing the wallet with `walletPrivateKey` and uploading the artifact. An external contributor can therefore cause attacker-controlled artifacts to be stored using the repository owner's Filecoin wallet, incurring unauthorized storage expenditure, dataset pollution and consumption of configured wallet funds. Disclosure of the wallet private key is not required. The 0.x action line is not receiving a backport and must be migrated to a fixed 1.x release. This issue is fixed in version 1.1.0.
Impact
Affected Products
The following products are affected by CVE-2026-58412
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | MITRE-CVE |
Upgrade to version 1.1.0 or later to fix the supply chain vulnerability.
- Update Filecoin Pin to version 1.1.0 or later.
- Migrate from the 0.x action line to a fixed 1.x release.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-58412 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.