EUVD-2026-37949Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Attacker must control a reclaimed GitHub login (PR:L) and rely on a pre-existing abandoned-username condition (AC:H); compromise of a feedstock affects downstream package consumers, justifying S:C and high integrity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository invitation routing, rather than stable, immutable GitHub user IDs. Version 3.61.0 fixes the issue.
AnalysisAI
Unintended write access to conda-forge feedstock repositories in conda-smithy prior to 3.61.0 allows attackers who register an abandoned or relinquished GitHub username (a username takeover) to be auto-invited as a maintainer when the conda-forge webservices route repository invitations based on mutable usernames rather than immutable user IDs. The flaw maps to CWE-284 (Improper Access Control) and impacts the conda-forge package supply chain; no public exploit identified at time of analysis, but the GitHub security advisory GHSA-g95q-3cmj-fvh8 and a fix commit are public.
Technical ContextAI
conda-smithy is the automation tool used by conda-forge to provision and manage 'feedstock' GitHub repositories that build conda packages via hosted CI. The vulnerable logic in conda_smithy/github.py looked up recipe maintainers by their current GitHub login (username) when reconciling the GitHub team membership for a feedstock. GitHub usernames are mutable and can be reclaimed after account deletion or rename, while the numeric user ID is stable and immutable; trusting the login as an identity binding is the root cause and aligns with CWE-284 (Improper Access Control). The fix introduces a .recipe_maintainers.json file storing username-to-numeric-ID mappings and verifies, via helpers like pull_file_via_gh_api and a cached_username2id lookup, that any username listed in meta.yaml still resolves to the same GitHub user ID previously recorded before it is added to the feedstock team.
RemediationAI
Vendor-released patch: conda-smithy 3.61.0 - upgrade to this version or later, which records numeric GitHub user IDs in a .recipe_maintainers.json file and verifies that a recipe maintainer's current username still resolves to the same immutable user ID before granting feedstock team membership (see commit 3b0bcd92ebd6f41edd341401d84583a20911c587 and advisory GHSA-g95q-3cmj-fvh8). The conda-forge organization should ensure the patched webservices are deployed and audit existing feedstock teams against the new username-to-ID mapping to evict any members whose current login no longer matches the originally recorded user ID. Compensating controls for self-hosted forks that cannot upgrade immediately include disabling automated team reconciliation in webservices, requiring manual maintainer approval for newly invited GitHub logins, and proactively scanning maintainer lists for accounts that were recently renamed or recreated; the trade-off is increased operational toil and slower onboarding of legitimate maintainers.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today