GitHub blocks pwn request attacks in actions/checkout starting June 2026

Affected Systems

GitHub Actions workflows using actions/checkout with pull_request_target trigger. Organizations using GitHub Actions for CI/CD pipelines are affected. The security update applies to all repositories using the actions/checkout action after June 18, 2026.

Exploitation Status

Pwn request attacks are a known exploitation pattern in GitHub Actions. Attackers exploit pull_request_target workflows to execute malicious code with write permissions and access to secrets. Active exploitation of this technique has been documented in the wild.

Business Impact

Organizations relying on GitHub Actions for CI/CD may face workflow disruptions after June 18, 2026 if configurations are not updated. Pwn request attacks can lead to supply chain compromise, secret exfiltration, and unauthorized code execution with elevated repository permissions. Teams must audit and remediate vulnerable workflow configurations before the enforcement date to maintain operational continuity.

Urgency

🟡 Within a week

Recommended Actions

• Audit all GitHub Actions workflows using pull_request_target trigger combined with actions/checkout by May 2026
• Replace pull_request_target with pull_request trigger where elevated permissions are not required
• Implement explicit permission restrictions using the permissions key in workflow files to limit token scope
• Test updated workflows in non-production repositories before the June 18, 2026 enforcement date
• Monitor GitHub security advisories and Actions changelog for additional guidance on migration paths