VNX-GH-014: Authorisation by spoofable actor name

An if: trusts github.actor == '<bot>[bot]' in a workflow outsiders can trigger.

Updated 02 Nov 2026Checked against cli@24498404a, vdb-sca-match@v0.8.14

github.actor is whoever caused the latest event, not who wrote the code. An attacker can open a pull request that a bot later updates (for example by asking Dependabot to rebase), making the bot the actor while the attacker’s commits run with the privileges the check was meant to reserve for the bot.


Severity	High
Confidence	medium
CWE	CWE-290, CWE-863
Command	`vulnetix gha workflows`, `vulnetix gha audit`

Remediation

Check the pull request author (github.event.pull_request.user.login) and that the head repository is the base repository, or use the bot’s own metadata action.

Run only this rule

vulnetix gha workflows --rule VNX-GH-014

Scoring

CWSS vector at the rule’s default severity: CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:M/EC:N/P:W. A finding whose severity the repository’s settings moved is scored at its adjusted severity.

All rules: GitHub rules.

Edit this pageSources: vdb-sca-match/ghaudit/rules_workflows.go, cli/internal/ghtasks/docs.go