CVE-2026-44246

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44246", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T16:33:55.844Z", "datePublished": "2026-05-12T20:41:32.162Z", "dateUpdated": "2026-05-13T14:23:29.727Z"}, "containers": {"cna": {"title": "nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`", "problemTypes": [{"descriptions": [{"cweId": "CWE-1427", "lang": "en", "description": "CWE-1427:", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59"}], "affected": [{"vendor": "MIC-DKFZ", "product": "nnUNet", "versions": [{"version": "< 2.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T20:41:32.162Z"}, "descriptions": [{"lang": "en", "value": "nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1."}], "source": {"advisory": "GHSA-63mx-j37w-gh59", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T14:23:08.264352Z", "id": "CVE-2026-44246", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:23:29.727Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44246", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T14:23:08.264352Z"}}}], "references": [{"url": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:23:25.889Z"}}], "cna": {"title": "nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`", "source": {"advisory": "GHSA-63mx-j37w-gh59", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "MIC-DKFZ", "product": "nnUNet", "versions": [{"status": "affected", "version": "< 2.4.1"}]}], "references": [{"url": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59", "name": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1427", "description": "CWE-1427:"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T20:41:32.162Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44246", "state": "PUBLISHED", "dateUpdated": "2026-05-13T14:23:29.727Z", "dateReserved": "2026-05-05T16:33:55.844Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T20:41:32.162Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nnUNet", "vendor": "MIC-DKFZ", "versions": [{"status": "affected", "version": "< 2.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dkfz:nnu-net:*:*:*:*:*:*:*:*", "matchCriteriaId": "13B07C8B-909B-41F8-913E-B0335C722A90", "versionEndExcluding": "2.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1."}, {"lang": "es", "value": "nnU-Net es un framework de segmentaci\u00f3n sem\u00e1ntica que adapta autom\u00e1ticamente su pipeline a un conjunto de datos. Antes de la versi\u00f3n 2.4.1, el flujo de trabajo de triaje de incidencias de nnU-Net en .github/workflows/issue-triage.yml es vulnerable a la Inyecci\u00f3n de Flujo de Trabajo Ag\u00e9ntico. El flujo de trabajo establece allowed_non_write_users: ${{ github.event.issue.user.login }}, lo que significa que cualquier usuario de GitHub con sesi\u00f3n iniciada que abra una incidencia puede alcanzar este flujo de trabajo ag\u00e9ntico con contenido controlado por el atacante. El t\u00edtulo y el contenido del cuerpo de la incidencia no confiables se incrustan directamente en el prompt de anthropics/claude-code-action, y el flujo de trabajo luego ejecuta un agente Claude con capacidad de comando con permiso para comentar y reetiquetar la incidencia actual a trav\u00e9s de gh. Debido a que este flujo de trabajo se activa autom\u00e1ticamente en issues.opened, un atacante externo puede enviar una incidencia manipulada que desv\u00eda al agente m\u00e1s all\u00e1 de su prop\u00f3sito previsto de triaje de incidencias e influye en las acciones de incidencia autenticadas. Esta vulnerabilidad se corrige en la versi\u00f3n 2.4.1."}], "id": "CVE-2026-44246", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44246", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T14:23:08.264352Z", "version": "2.0.3"}}]}, "published": "2026-05-12T21:16:16.543", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "nnUNet", "source": "cna", "vendor": "MIC-DKFZ"}, "product": "nnunet", "vendor": "mic-dkfz"}], "created": "2026-05-12T22:45:15.536064+00:00", "updated": "2026-05-19T22:00:12.605171+00:00", "vendors": ["mic-dkfz", "mic-dkfz$PRODUCT$nnunet"]}