Critical severity9.9NVD Advisory· Published Feb 26, 2026· Updated Jun 17, 2026
CVE-2026-27941
CVE-2026-27941
Description
OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the pull_request_target event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged GITHUB_TOKEN and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:openlit:openlit_software_development_kit:*:*:*:*:*:python:*:*Range: >=1.36.2,<1.37.1
Patches
Vulnerability mechanics
References
2- github.com/openlit/openlit/commit/4a62039a1659d6cbb8913172693f587b5fc2546cnvdPatch
- github.com/openlit/openlit/security/advisories/GHSA-9jgv-x8cq-296qnvdExploitMitigationVendor Advisory
News mentions
0No linked articles in our index yet.