CVE-2026-47690 meltano CVE debrief

Who should care

Users of MeltanoHub prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 should assess and apply the fix. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and adjust workflow configurations. They should also monitor for suspicious activity related to GITHUB_TOKEN and implement compensating controls for secret protection.

Technical summary

MeltanoHub, the source code for hub.meltano.com, had a vulnerability in versions prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173. The issue allowed for exfiltration of `GITHUB_TOKEN` with write permissions to the repository due to a vulnerable workflow using pull_request_target, which runs in the context of the base repository with access to secrets. The fix was introduced in commit 923820de8f64d753951fbbd54f7282a3d5f75173. Users should verify their deployments and apply the fix.

Defensive priority

High priority due to CVSS score of 7.5 and potential for secret exfiltration.

Recommended defensive actions

• Inventory and assess use of MeltanoHub
• Apply fix from commit 923820de8f64d753951fbbd54f7282a3d5f75173
• Monitor for suspicious activity related to GITHUB_TOKEN
• Review and adjust workflow configurations
• Implement compensating controls for secret protection
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from official CVE and NVD sources, as well as GitHub commit and advisory records. The vulnerability was introduced due to a workflow using pull_request_target, which runs in the context of the base repository with access to secrets. Users should verify their deployments and apply the fix from commit 923820de8f64d753951fbbd54f7282a3d5f75173. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.