Executive brief
oasdiff-action is a GitHub Action that automatically checks pull requests for breaking changes in API specifications (OpenAPI files). Before version 0.0.51, the tool enabled the resolution of external URL references in these specifications by default, allowing attackers to exploit this feature in untrusted pull requests (especially fork PRs on public repositories) to retrieve sensitive files from the CI runner or access internal services—a classic server-side request forgery (SSRF) vulnerability.
Technical details
The vulnerability is a server-side request forgery (SSRF) flaw in oasdiff-action's handling of external $ref entries in OpenAPI specifications. The action runs on pull request events and by default resolves external references (allow-external-refs: true) without validating the source or the runner's network context. An attacker can submit a malicious pull request (particularly effective from fork PRs on public repos where the action is workflow-triggered) containing an OpenAPI spec with $ref entries pointing to internal resources (localhost, private IPs, internal service URLs, or local file paths). When the action executes, the runner fetches and processes these references, exposing the structured data or enabling interaction with internal services. The fix (released in version 0.0.51) changes the default to allow-external-refs: false, and requires explicit opt-in via action configuration for specs that legitimately need external ref resolution.
Affected products
- oasdiff oasdiff-action before 0.0.51
Timeline
- 2026-08-31: disclosed
- 2026-05-30: patched: version 0.0.51 released with allow-external-refs defaulting to false