What is the CVSS score of CVE-2026-47690?

CVE-2026-47690 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Hub are affected by CVE-2026-47690?

A critical vulnerability in the meltano/hub GitHub repository allows unauthenticated attackers to steal administrative GitHub tokens through pull request submission, with publicly available exploit…. A patch is available.

Is there a public PoC exploit available for CVE-2026-47690?

Yes, a public proof-of-concept exploit is available for CVE-2026-47690. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-47690?

Within 24 hours, identify all internal projects and CI/CD pipelines that reference or depend on meltano/hub, and audit recent pull request activity for suspicious modifications. Within 7 days, enforce mandatory code review and approval requirements for all pull requests in affected repositories, rotate all GitHub tokens with repository-write access, and disable the vulnerable test_dispatcher.yml workflow if operationally feasible. Within 30 days, implement permanent protections by replacing pull_request_target triggers with pull_request events using read-only token contexts, enforce strict branch protection rules preventing untrusted code execution, and monitor the meltano/hub project for security updates from the vendor.

Hub CVE-2026-47690

EUVD-2026-46420 HIGH

Command Injection (CWE-77)

2026-07-21 GitHub_M

Command Injection Hub

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 21, 2026 - 23:36 EUVD

Source Code Evidence Fetched

Jul 21, 2026 - 21:40 vuln.today

Analysis Generated

Jul 21, 2026 - 21:40 vuln.today

CVE Published

Jul 21, 2026 - 20:46 cve.org

HIGH 7.5

DescriptionCVE.org

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUB_TOKEN with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available.

AnalysisAI

Privileged GITHUB_TOKEN exfiltration in the meltano/hub repository allows any unauthenticated attacker who can open a pull request to inject shell commands into the test_dispatcher.yml GitHub Actions workflow and steal a repository-write token. Because the workflow uses the pull_request_target trigger, it executes untrusted PR-controlled data (changed filenames) in the trusted base-repository context with access to secrets. Publicly available exploit code exists (a dedicated PoC repo), though this is not listed in CISA KEV.