CVE-2026-119289
Tenable Plugin
Checking the public Tenable catalog…
AI Threat Summary
CVE-2026-119289 is a high-severity vulnerability with a CVSS score of 7.1 affecting the target software. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.
Description
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.
Attack Chain
Attacker scans for vulnerable versions using version banners or PoC scanners
Attacker triggers CVE-2026-119289 vulnerability with a crafted request or payload
Vulnerability exploited to perform unauthorized actions on the target system
Depending on vulnerability type, attacker achieves data access, service disruption, or code execution
MITRE ATT&CK Techniques
Indicators of Compromise
| Type | Value | Description | |
|---|---|---|---|
| user_agent | Mozilla/5.0 (compatible; exploit/1.0) |
Generic exploit scanner user agent pattern | |
| url | /api/vuln-endpoint?payload=<malicious> |
Exploit attempt against application endpoint — monitor access logs for anomalous params |
Remediation
Quick Facts
| CVE ID | CVE-2026-119289 |
| CVSS Score | 7.1 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L |
| Published | 2026-10-30 |
| Exploited | No |
| CISA KEV | No |
| PoC | Available |