Is CVE-2026-42298 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42298 being exploited in the wild.

How severe is CVE-2026-42298?

Critical severity, with a CVSS score of 10, published 8 May 2026.

Which products and versions are affected?

Gitroom Postiz Before commit da44801, Prior to commit da44801.

Is there a fix for CVE-2026-42298?

A patch was published on 2026-04-22: Fix developed and published via commit da44801 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42298 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42298?

Check whether you run Gitroom Postiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42298: Gitroom Postiz code injection in GitHub Actions workflow

CVE-2026-42298 · Severity: critical · CVSS 10 · Published 2026-05-08

A security flaw in the automated build system for Postiz, a social media scheduling tool, allows unauthorized individuals to take control of the software's development environment. By submitting a malicious contribution request, an attacker can steal high-level access keys, allowing them to modify the application's source code, delete data, or release fraudulent versions of the software. This poses a severe risk to the integrity of the product and the security of its users.

Technologies: Gitroom Postiz. Vendors: Gitroom.

Quick answers

Is CVE-2026-42298 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42298 being exploited in the wild.
How severe is CVE-2026-42298?: Critical severity, with a CVSS score of 10, published 8 May 2026.
Which products and versions are affected?: Gitroom Postiz Before commit da44801, Prior to commit da44801.
Is there a fix for CVE-2026-42298?: A patch was published on 2026-04-22: Fix developed and published via commit da44801 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42298 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42298?: Check whether you run Gitroom Postiz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A 'Pwn Request' vulnerability exists in the 'Build and Publish PR Docker Image' workflow (.github/workflows/pr-docker-build.yml). The root cause is the execution of a Docker build process using a 'Dockerfile.dev' that can be modified by external contributors in a Pull Request. An unauthenticated attacker can submit a PR from a fork containing a malicious Dockerfile; when the automated workflow triggers, it executes the attacker's code within the runner environment. This environment has access to a GITHUB_TOKEN with 'write-all' permissions, which can be exfiltrated to grant the attacker full read/write access to the repository, including the ability to modify code and manage releases. The issue was resolved by removing the insecure workflow in commit da44801.

Affected products

Gitroom Postiz Before commit da44801

Timeline

2026-04-22: disclosed: Advisory received and acknowledged by Postiz
2026-04-22: patched: Fix developed and published via commit da44801
2026-04-26: advisory: CVE-2026-42298 assigned
2026-05-08: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.