What is the CVSS score of CVE-2026-40903?

CVE-2026-40903 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40903?

Yes, a patch is available for CVE-2026-40903. Update the affected software to the latest version immediately.

goshs CVE-2026-40903

EUVD-2026-24282 CRITICAL

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-04-21 GitHub_M

Information Disclosure Goshs

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

May 01, 2026 - 16:15 nvd

Patch available

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Patch available

Apr 21, 2026 - 21:02 EUVD

Analysis Generated

Apr 21, 2026 - 20:51 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24282

Analysis Generated

Apr 21, 2026 - 20:00 vuln.today

CVE Published

Apr 21, 2026 - 19:43 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

AnalysisAI

Remote unauthenticated attackers can leak GitHub workflow tokens from goshs repositories via ArtiPACKED attack. The vulnerability exploits artifact packaging mechanisms to extract GITHUB_TOKEN credentials despite the token never appearing in source code. With CVSS 9.1 (Critical) and network attack vector requiring no authentication, this poses immediate risk to CI/CD pipelines using goshs. No public exploit identified at time of analysis, though the attack technique (ArtiPACKED) is documented. EPSS data unavailable; not listed in CISA KEV.

Technical ContextAI

This is an ArtiPACKED vulnerability (CWE-829: Inclusion of Functionality from Untrusted Control Sphere) affecting goshs, a SimpleHTTPServer implementation in Go. ArtiPACKED is a supply chain attack technique that exploits how GitHub Actions artifacts are packaged and stored, allowing sensitive tokens to leak through workflow artifacts even when not present in repository source. The vulnerability stems from improper isolation between build artifacts and sensitive CI/CD credentials. The GITHUB_TOKEN, used for authenticating GitHub API requests within workflows, can be extracted from artifacts generated during the build process. This represents a broader class of CI/CD security issues where ephemeral credentials intended for workflow execution inadvertently persist in build outputs.

RemediationAI

Upgrade to goshs version 2.0.0-beta.6 or later, which contains the vendor-released patch addressing the ArtiPACKED vulnerability. Refer to the GitHub Security Advisory at https://github.com/patrickhener/goshs/security/advisories/GHSA-hpxj-9fgp-fhhf for upgrade instructions and release notes. Until patching is complete, organizations should implement compensating controls: review and purge existing GitHub workflow artifacts from repositories using vulnerable goshs versions to prevent token harvesting from historical artifacts (note: this requires manual artifact deletion and does not prevent future leakage); rotate GITHUB_TOKEN and any repository secrets that may have been exposed through artifacts in the past 90 days (artifact retention period); restrict artifact access permissions to minimum necessary users and consider making artifact downloads require authentication; disable goshs usage in CI/CD workflows temporarily and substitute with alternative HTTP servers if immediate upgrade is not feasible (trade-off: may break existing automation). Each mitigation carries operational overhead and none fully eliminates risk without the version upgrade.