Is CVE-2026-123852 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123852 being exploited in the wild.

How severe is CVE-2026-123852?

High severity, with a CVSS score of 7.4, published 6 November 2026.

Which products and versions are affected?

Jetbrains Junie GitHub Action before 1.8.0.

Is there a fix for CVE-2026-123852?

Yes: fixed in 1.8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123852 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-123852?

Check whether you run Jetbrains Junie GitHub Action at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123852: JetBrains Junie GitHub Action code execution via fork updates

CVE-2026-123852 · Severity: high · CVSS 7.4 · Published 2026-11-06

JetBrains Junie is a GitHub Action used to automate tasks in CI/CD pipelines with access to sensitive workflow credentials. An attacker with fork access can execute arbitrary code with those credentials by manipulating fork updates, potentially compromising the pipeline and accessing secrets or modifying protected repositories.

Vendors: Jetbrains.

Quick answers

Is CVE-2026-123852 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123852 being exploited in the wild.
How severe is CVE-2026-123852?: High severity, with a CVSS score of 7.4, published 6 November 2026.
Which products and versions are affected?: Jetbrains Junie GitHub Action before 1.8.0.
Is there a fix for CVE-2026-123852?: Yes: fixed in 1.8.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123852 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-123852?: Check whether you run Jetbrains Junie GitHub Action at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.8.0

Technical details

The vulnerability allows remote code execution in GitHub Actions workflows through insecure handling of fork updates in the Junie action before version 1.8.0. An attacker who can create or control a forked repository can inject malicious code that executes with the permissions of the GitHub workflow credentials. The attack requires the victim to run the action on a fork, which may occur automatically in many CI/CD configurations.

Affected products

JetBrains Junie GitHub Action before 1.8.0

Timeline

2026-11-06: disclosed

References

https://www.jetbrains.com/privacy-security/issues-fixed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.