What is the CVSS score of CVE-2026-44246?

CVE-2026-44246 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of nnU-Net are affected by CVE-2026-44246?

nnU-Net's automated GitHub Actions workflows prior to version 2.4.1 can be hijacked by any user with GitHub access through crafted issues (proof-of-concept code exists), potentially allowing…. A patch is available.

How to fix or mitigate CVE-2026-44246?

Within 24 hours, assess your organization's use of nnU-Net and verify whether this automated workflow is enabled in your repositories. Within 7 days, upgrade all instances of nnU-Net to version 2.4.1 or later and confirm the GitHub Actions workflow configuration has been updated. Within 30 days, audit GitHub Actions execution logs and issue modification records for any signs of unauthorized activity or unexpected repository changes.

nnU-Net CVE-2026-44246

EUVD-2026-29841 HIGH

Improper Neutralization of Input Used for LLM Prompting (CWE-1427)

2026-05-12 GitHub_M

Code Injection Nnunet

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Remote, low-complexity, auto-triggered on issue open with no repo privileges (PR:N) or user interaction; injection crosses into the agent's gh authority (S:C) but impact is limited to issue comment/relabel (C:L/I:L/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:24 vuln.today

Patch available

May 12, 2026 - 22:03 EUVD

CVE Published

May 12, 2026 - 20:41 nvd

HIGH 7.2

DescriptionGitHub Advisory

nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1.

AnalysisAI

Agentic workflow injection in nnU-Net's GitHub Actions issue-triage automation (prior to 2.4.1) lets any logged-in GitHub user hijack a command-capable Claude agent by opening a crafted issue. Because the workflow embeds untrusted issue title/body directly into the LLM prompt and grants the agent authenticated gh permissions to comment and relabel issues, an external attacker can steer it beyond triage into performing repository actions on their behalf. A proof-of-concept is indicated (SSVC exploitation=poc), but EPSS is very low (0.04%) and it is not in CISA KEV, so no active exploitation is confirmed.

Technical ContextAI

The vulnerability lives in the CI/CD supply-chain layer rather than the nnU-Net segmentation code itself. The .github/workflows/issue-triage.yml workflow uses anthropics/claude-code-action to run an LLM agent that reads issue content and takes triage actions. The misconfiguration allowed_non_write_users: ${{ github.event.issue.user.login }} effectively whitelists whoever opened the issue, so untrusted input from an unauthenticated-to-the-repo party flows into a privileged agent. This maps to CWE-1427 (Improper Neutralization of Input Used for LLM Prompt, i.e. prompt injection): the agent cannot distinguish system/triage instructions from attacker-supplied issue text, so instructions embedded in the title or body are executed with the workflow's gh token scope (commenting and relabeling the current issue).

RemediationAI

Vendor-released patch: upgrade to nnU-Net 2.4.1, which fixes the workflow (see GHSA-63mx-j37w-gh59: https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59). For anyone maintaining a fork or a downstream copy of the workflow who cannot immediately pull the fix, remove the allowed_non_write_users: ${{ github.event.issue.user.login }} line so issue authors are no longer auto-trusted (trade-off: external issues will no longer be auto-triaged), restrict the agent to a read-only/no-gh-write token or drop its comment/relabel permissions (trade-off: loses automated labeling), and avoid interpolating raw issue title/body into the agent prompt - treat that content strictly as data, or gate the workflow behind a maintainer approval step (trade-off: added latency before triage runs). The simplest durable control is upgrading to 2.4.1 rather than hand-patching.