CVE-2026-54160

HighCVSS 8.2

Published: 28/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

In Network UPS Tools prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments was mis-structured, mixing code running with higher privileges (single-use token with write permissions) and untrusted inputs (PR source branch). A malicious PR from a fork could extract the GITHUB_TOKEN value, potentially allowing manipulation of repository contents, commit checks/statuses, or PR comments.

Risk Assessment

Exposure of GITHUB_TOKEN could allow an attacker to make unauthorized modifications to the repository, CI statuses, or PR comments, potentially compromising project integrity.

Recommendation

Update Network UPS Tools to a version containing the fixes (commits 658b24e and 1aa31d1). Additionally, restrict permissions of tokens used in GitHub Actions and rotate them regularly.

Other vulnerabilities in Network UPS Tools

CVE-2026-54161High
In Network UPS Tools 2.8.3 through 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify(), async_notify(), and wall(). When a monitored device reports an ALARM state and NOTIFYCMD with EXEC is configured in NOTIFYFLAG ALARM, shell metacharacters in the alarm text are evaluated and can execute arbitrary OS commands as the upsmon account, commonly root.

Original NVD description (English source)

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was mis-structured in terms of mixing code running with higher privileges (single-use token generated with write permissions) and untrusted inputs (PR source branch). A malicious PR run from a fork could extract the GITHUB_TOKEN value. It could potentially be abused while it was valid (while the GHA job ran) to manipulate Git repository contents, commit checks/statuses, or issue/PR comments, according to permissions it was issued with. This issue has been patched via commits 658b24e and 1aa31d1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS