EUVD-2026-37949Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Attacker must control a reclaimed GitHub login (PR:L) and rely on a pre-existing abandoned-username condition (AC:H); compromise of a feedstock affects downstream package consumers, justifying S:C and high integrity.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L
Lifecycle Timeline
3DescriptionCVE.org
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub username takeover. The root cause is the use of mutable GitHub usernames as identifiers for repository invitation routing, rather than stable, immutable GitHub user IDs. Version 3.61.0 fixes the issue.
AnalysisAI
Unintended write access to conda-forge feedstock repositories in conda-smithy prior to 3.61.0 allows attackers who register an abandoned or relinquished GitHub username (a username takeover) to be auto-invited as a maintainer when the conda-forge webservices route repository invitations based on mutable usernames rather than immutable user IDs. The flaw maps to CWE-284 (Improper Access Control) and impacts the conda-forge package supply chain; no public exploit identified at time of analysis, but the GitHub security advisory GHSA-g95q-3cmj-fvh8 and a fix commit are public.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a conda-forge feedstock whose recipe/meta.yaml still lists a GitHub username belonging to an account that has since been deleted, renamed, or otherwise made available; (2) the attacker successfully registering that exact GitHub username on github.com; and (3) the conda-forge automated webservices running conda-smithy's configure_github_team reconciliation against that feedstock prior to the 3.61.0 fix being deployed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L (7.6) indicates network-reachable, low-complexity, unauthenticated exploitation requiring user interaction, with high integrity impact - consistent with the takeover scenario where an attacker registers an abandoned login that conda-forge automation then invites as a maintainer. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a former conda-forge maintainer whose GitHub account was deleted or renamed, registers a new GitHub account with that exact (now-available) username, and waits for the conda-forge automated webservices to re-run maintainer reconciliation on a feedstock that still lists the old username in recipe/meta.yaml. The automation invites the attacker-controlled account to the feedstock team, granting write access to push malicious build recipes that are then published as conda-forge packages to downstream users. |
| Remediation | Vendor-released patch: conda-smithy 3.61.0 - upgrade to this version or later, which records numeric GitHub user IDs in a .recipe_maintainers.json file and verifies that a recipe maintainer's current username still resolves to the same immutable user ID before granting feedstock team membership (see commit 3b0bcd92ebd6f41edd341401d84583a20911c587 and advisory GHSA-g95q-3cmj-fvh8). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit your infrastructure to identify all conda-smithy deployments and document versions currently in use; cross-reference with conda-forge maintainer accounts for unauthorized or suspicious recent additions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today