Back to the CVE list

CVE-2026-119290Suited to automated attack · CISA

Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

CVSS score

7.5

EPSS probability

—

Risk score

0.8

Published

1 h ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

8.0

CVE-2026-119287Zuke: Command-form registry descriptors bypass the MCP launch policy

Vendorzuke-build Productzuke

Patch status unknown1 h ago

7.1

CVE-2026-119289Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate

Vendorzuke-build Productzuke

Patch status unknown1 h ago

7.0

CVE-2026-119288Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

Vendorzuke-build Productzuke

Patch status unknown1 h ago

5.5

CVE-2026-119291zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory

Vendorzuke-build Productzuke

Patch status unknown1 h ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-119290"

CVE-2026-119290 · Zuke: Resolved secret() values are written…