42
55
30
55
55
60
60
47
55
42
55
We got admin access to Baseten's production GitHub in 25 minutes
Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.
Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.
58
55
42
42
30
35
42
42
42
47
30
55
30
60
35
60
42
30
GitHub Pays $100,000 Bounty for Critical RCE Flaw in Git Push Pipeline
GitHub paid Saif Ghani $100,000 for CVE-2026-3854, a critical unauthenticated RCE in its Git push pipeline allowing command execution on backend infrastructure.
GitHub awarded researcher Saif Ghani $100,000, its largest publicly disclosed bug bounty, for CVE-2026-3854, a critical unauthenticated remote code execution flaw in its Git push processing pipeline. A crafted repository URL could trigger arbitrary command execution on backend infrastructure, threatening source code integrity, repository secrets, and software supply chains. GitHub deployed mitigations and completed a patch rollout through coordinated disclosure before technical details became public.
58
Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection
Wiz disclosed a GitHub Actions workflow injection in Snowflake's snowflake-connector-net repo that exposed Jira API tokens; Snowflake patched the flaw.
Wiz disclosed a workflow injection flaw in Snowflake's snowflake-connector-net repository, where attacker-controlled GitHub issue fields were expanded directly into a shell run block. Wiz's Red Agent exploited it during authorized security testing, received an out-of-band runner callback and retrieved a Jira API token with read access to engineering, security compliance and bug bounty projects. Snowflake merged a fix on June 23, 2026, rotated the token and said its investigation found no evidence of unauthorized access. No CVE, CVSS score or KEV entry has been assigned for the issue.
45
60
42
30
30
30
30
30
47
60