CVE-2026-24059

score

0.1

cvss

6.5

epss

0.4%

published

2026-08-13

kev added

—

first seen

2026-10-21

GitHub Actions API GET /api/v1/user/actions/runners/registration-token endpoint misclassifies token creation as read-only, letting attackers with leaked read:user tokens create malicious runners executing workflows with repo secrets access, exploit requires leaked read:user token.