Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by GitHub_M

CVE-2026-53507oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

High 8.3

In plain English

A high-severity information exposure in oasdiff-action from oasdiff. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 4.0)8.3High
Exploit odds (30 days)0.5%top 57.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default (allow-external-refs: true). When an action runs on a pull request whose spec is attacker-controlled — most importantly fork pull requests on public repositories — a $ref in that spec is fetched/read on the runner with no interaction required, enabling SSRF and disclosure of structured files on the runner. This issue has been patched in version 0.0.51.

Affected products (as reported)

VendorProductVersions
oasdiff oasdiff-action < 0.0.51

Weakness: CWE-200, CWE-918, CWE-1188 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References