VNX-GH-209: GitHub Actions can approve pull requests

Workflows may create and approve pull requests.

Updated 02 Nov 2026Checked against cli@24498404a, vdb-sca-match@v0.8.14

A workflow token that can approve pull requests satisfies a one-approval rule on its own: one compromised workflow opens and approves its own change.


Severity	Medium
Confidence	high
CWE	CWE-862
Command	`vulnetix gha settings`, `vulnetix gha audit`
Needs	repo, actions policy. Without them the rule is reported as not evaluated, never as passed.

Remediation

Disable “Allow GitHub Actions to create and approve pull requests”.

Run only this rule

vulnetix gha settings --rule VNX-GH-209

Scoring

CWSS vector at the rule’s default severity: CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:M/EX:M/EC:N/P:W. A finding whose severity the repository’s settings moved is scored at its adjusted severity.

All rules: GitHub rules.

Edit this pageSources: vdb-sca-match/ghaudit/rules_settings.go, cli/internal/ghtasks/docs.go