CVE-2026-14967 Black Lantern Security CVE debrief

Who should care

Operators of BBOT, especially those using the `github_workflows` module, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and adjusting the configuration of BBOT's `github_workflows` module and monitoring for potential path traversal attacks. Security teams and vulnerability management teams should also be aware of this vulnerability and plan for vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retesting of remediated assets, and closing the item only after evidence is documented are also important. Asset inventory management and source tracking can help in identifying and mitigating the vulnerability. Rollback and change windows should be considered for remediation efforts. This vulnerability can have operational impacts if not properly mitigated, and understanding the affected scope and severity is crucial for effective remediation. The CVE record and vendor guidance should be reviewed to validate affected scope, severity, and vendor guidance. The configuration of BBOT's `github_workflows` module should be reviewed and adjusted as necessary to prevent exploitation. Monitoring and detection capabilities should be reviewed to ensure they can detect potential exploitation attempts. Asset inventory and source tracking can help in identifying and mitigating the vulnerability. Compensating controls, such as restricting access to sensitive areas or implementing additional security measures, should be considered while remediation is scheduled and verified. The vulnerability management team should track exceptions, retest remediated assets, and close the item only after evidence is documented. The security team should review compensating controls for exposed systems while remediation is scheduled and verified. The operational impact of this vulnerability can be significant if not properly mitigated, and it is essential to prioritize updating BBOT to a version that, 7

Technical summary

The BBOT `github_workflows` module is vulnerable to a path traversal attack, allowing an attacker to write a downloaded artifact outside its configured output directory. The vulnerability is due to the path-containment check not resolving `..`. This could allow an attacker to write files to unintended locations, potentially leading to security issues. The vulnerability is bounded to two directory levels above the output location, and the target is determined by the operator's configuration.

Defensive priority

Operators should prioritize updating BBOT to a version that includes the patch, as the vulnerability allows for potential path traversal attacks.

Recommended defensive actions

• Update BBOT to a version that includes the patch
• Review and adjust the configuration of BBOT's `github_workflows` module
• Monitor for potential path traversal attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description indicates that BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory due to a path-containment check not resolving `..`. A crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.

Official resources