GitHub Actions pwn-request fixes still leave checkout gaps
Original title: The Pwn Request Reckoning: What Still Works Against GitHub Actions
Old actions/checkout SHA pins and triggers such as issue_comment can still run fork code with secrets.
Wiz says GitHub’s 2026 GitHub Actions changes make the default pull_request_target “pwn request” harder but do not remove the class. actions/checkout now blocks fork checkouts on untrusted triggers, cache tokens for those triggers are read-only, and a default public-repo policy blocking pull_request_target is scheduled for enforcement on December 2, 2026. Private and internal repositories and workflow_run stay outside that default. Workflows that pin pre-backport checkout SHAs, use other checkout tools, or run issue_comment and repository_dispatch with secrets can still execute untrusted code.
Unconfirmed: December 2, 2026 enforcement is described as scheduled, not already in force.
- checkout@v7.0.0 shipped June 18, 2026, and blocks fork checkouts by default.
- Backports cover v2.8.0, v3.7.0, v4.4.0, v5.1.0 and v6.1.0; v1 is excluded.
- Read-only cache tokens for untrusted triggers arrived June 26, 2026.
- A SHA pin from before the July 20 backport skips the new checks.
- issue_comment bot commands remain exploitable even on checkout v7.
Impact: Untrusted pull-request code can run with repository secrets
| Product | Affected | Fixed in |
|---|---|---|
| GitHub actions/checkout | versions before v2.8.0, v3.7.0, v4.4.0, v5.1.0, v6.1.0 and v7.0.0, including @v4.3.0 | v2.8.0, v3.7.0, v4.4.0, v5.1.0, v6.1.0, or v7.0.0+ |
- 1.Update SHA-pinned actions/checkout refs to the patched releases Wiz lists.
- 2.Check commenter repository permission for issue_comment commands, not author_association.
- 3.Treat opt-in pull_request_target workflows as still privileged over untrusted input.
- Vendors
- GitHub
- Products
- GitHub Actionsactions/checkout
- Organizations
- Wiz
From the original article
8 min read at wiz.io
GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.
By Shay Berkovich · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.