CVE-2026-27941: OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the…

PriorityP260critical9.9CVSS 3.1

AVNACLPRLUINSCCHIHAH

EPSS

0.40%

31.4th percentile

OpenLIT is an open source platform for AI engineering. Prior to version 1.37.1, several GitHub Actions workflows in OpenLIT's GitHub repository use the `pull_request_target` event while checking out and executing untrusted code from forked pull requests. These workflows run with the security context of the base repository, including a write-privileged `GITHUB_TOKEN` and numerous sensitive secrets (API keys, database/vector store tokens, and a Google Cloud service account key). Version 1.37.1 contains a fix.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
openlit	openlit	< 1.37.1	1.37.1
openlit	openlit_software_development_kit	>= 1.36.2 < 1.37.1	1.37.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.