Patch SaltStack Docs Repo to Block Malicious PR Code and Prevent Secret Theft
A critical flaw in the SaltStack documentation repository allowed attackers to steal secrets by injecting malicious code into forked pull requests before a recent patch.
Key points
- The vulnerability allows execution of attacker-controlled code in privileged workflow environments.
- Exposed secrets include CF_API_TOKEN, GH_TOKEN, and write-capable GITHUB_TOKEN credentials.
- Commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 fixes the issue by altering workflow behavior.
The SaltStack documentation repository, which builds and deploys the docs.saltbox.dev website, contained a critical vulnerability identified as CVE-2026-55675. According to the National Vulnerability Database, the flaw allowed unauthorized code execution within the repository's continuous integration environment. The issue stemmed from how the system handled forked pull requests and their associated artifacts during the build process. This exposure placed sensitive credentials at significant risk of disclosure.
The risk
Prior to the fixing commit, the trigger-pr-build.yml workflow recorded untrusted fork commit data in an artifact called pr_info. The subsequent build-pr.yml job, which held sensitive secrets, checked out that specific commit before installing Python dependencies. This sequence allowed an attacker to supply a malicious setup.py or PEP 517 build hook. When the privileged workflow ran pip install, the attacker-authored code executed with access to CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN, enabling full account compromise.
Who is exposed
The vulnerability affected the saltyorg docs repository specifically in versions prior to commit 649c9aea2daef1168eeb0415b44e65dbbde9f220. The National Vulnerability Database rates this issue as Critical with a CVSS score of 10. The weakness involves improper control of interaction between components and the injection of code. This exposure is specific to the documentation infrastructure and does not directly impact the core SaltStack orchestration software used by operators for configuration management.
Cost and compliance
The source material does not provide specific financial costs, regulatory penalties, or compliance impacts associated with this vulnerability. No data regarding actual incidents, breached accounts, or forensic findings from real-world exploitation is included in the National Vulnerability Database record. The record strictly details the technical mechanism of the flaw and the remediation commit. Organizations must determine their own compliance implications based on how they classify exposure of CI/CD pipeline secrets.
Our take on the response
That suggests teams should audit their own GitHub Actions workflows for similar patterns where untrusted fork data influences privileged build steps. Managers should verify that build jobs do not check out arbitrary commits from forks before running installation commands. Ensuring that secret-bearing workflows are isolated from untrusted artifact data is essential for preventing this type of supply chain compromise in documentation or secondary repositories.
What defenders should look for
Teams usually detect this by monitoring for unexpected package installations or outbound connections from CI/CD runners. Check whether workflows execute code derived from forked pull requests before validating the source. Look for anomalous token usage or API calls originating from build environments. If suspicious activity appears, immediately rotate all exposed secrets and disable the affected workflows. Review audit logs for any commits pushed using stolen credentials and isolate compromised runner instances to prevent further lateral movement within the repository ecosystem.
What to do and how to stay safe: SaltStack
- Verify that your documentation repositories are updated to include commit 649c9aea2daef1168eeb0415b44e65dbbde9f220.
- Audit GitHub Actions workflows to ensure secret-bearing jobs do not check out code from untrusted forks.
- Rotate any secrets that were accessible in workflows handling forked pull requests, including API tokens and GitHub tokens.
- Monitor logs for unexpected package installations or executions during the build phase of pull request processing.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does CVE-2026-55675 affect the main SaltStack configuration management software?
No, the vulnerability is specific to the saltyorg documentation repository that builds the docs.saltbox.dev website, not the core SaltStack product.
What secrets were exposed by this vulnerability?
The flaw exposed CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY, and a write-capable GITHUB_TOKEN stored in the workflow environment.
Is there a fix available for this vulnerability?
Yes, the vulnerability is fixed in commit 649c9aea2daef1168eeb0415b44e65dbbde9f220 of the saltyorg docs repository.
