GitHub Agentic Workflows leak private repo data via public issues

Affected Systems

GitHub Agentic Workflows with cross-repository read access. Organizations using GitHub agents that can access both public and private repositories are vulnerable. No CVE assigned yet.

Exploitation Status

Vulnerability disclosed by Noma Security researchers. Exploitation requires only the ability to open public issues on repositories monitored by affected agents. No credentials or organization access needed. Active exploitation status unknown.

Business Impact

Attackers can exfiltrate sensitive data from private repositories by crafting malicious issues in public repos. This bypasses access controls and could expose source code, secrets, API keys, or proprietary information. Organizations using GitHub agents for automation across multiple repositories face immediate data leakage risk. Impact is particularly severe for organizations with broad agent permissions.

Urgency

🟠 Within 24 hours

Recommended Actions

• Audit all GitHub Agentic Workflows for cross-repository read permissions and restrict agent access to minimum required repositories
• Review GitHub agent configurations and disable or limit agents that process public issues with access to private repositories
• Monitor GitHub audit logs for unusual agent activity, particularly agents accessing private repositories after public issue creation
• Implement input validation and sanitization for agent workflows that process user-submitted issue content
• Contact GitHub support for guidance on securing Agentic Workflows and check for available patches or configuration updates