Is CVE-2026-40316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40316 being exploited in the wild.

How severe is CVE-2026-40316?

High severity, with a CVSS score of 8.8, published 15 April 2026.

Is there a fix for CVE-2026-40316?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40316 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-40316?

Check whether you run OWASP BLT or Owasp Blt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40316: OWASP BLT Remote Code Execution in GitHub Actions workflow

CVE-2026-40316 · Severity: high · CVSS 8.8 · Published 2026-04-15

OWASP BLT, a platform for QA testing and vulnerability disclosure, contains a security flaw in its automated development workflows. An attacker can submit a malicious pull request that, when reviewed by a maintainer, executes unauthorized code within the project's build environment. This could allow an attacker to steal sensitive credentials (secrets), modify the source code repository, or launch supply chain attacks against users of the platform.

Vendors: OWASP.

Quick answers

Is CVE-2026-40316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40316 being exploited in the wild.
How severe is CVE-2026-40316?: High severity, with a CVSS score of 8.8, published 15 April 2026.
Which products and versions are affected?: OWASP BLT < 2.1.1.
Is there a fix for CVE-2026-40316?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40316 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-40316?: Check whether you run OWASP BLT or Owasp Blt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Remote Code Execution (RCE) vulnerability exists in the `.github/workflows/regenerate-migrations.yml` workflow due to an unsafe combination of a privileged trigger and untrusted input. The workflow uses `pull_request_target`, which grants the runner a `GITHUB_TOKEN` with write permissions even for forks. It specifically uses `git show` to copy an attacker-controlled `models.py` file into the trusted workspace and then runs `python manage.py makemigrations`. Because Django imports model modules during this process, any module-level Python code in the attacker's file is executed. This allows an unauthenticated external contributor to exfiltrate repository secrets or compromise the repository if a maintainer applies the 'regenerate-migrations' label to their pull request. The issue is addressed in version 2.1.1.

Affected products

OWASP BLT < 2.1.1

Timeline

2026-04-09: advisory: GitHub Security Advisory GHSA-wxm3-64fx-cmx9 published
2026-04-15: disclosed: CVE-2026-40316 published

References

https://github.com/OWASP-BLT/BLT/security/advisories/GHSA-wxm3-64fx-cmx9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.