CVE-2026-40903 Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence
Attackers can leak GITHUB_TOKEN via workflow artifacts in goshs, exposing sensitive credentials to unauthorized parties.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40903?
CVE-2026-40903 is a critical vulnerability in patrickhener goshs, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.
Weakness: CWE-829
Which versions are affected by CVE-2026-40903?
It affects 1 product.
Products include Goshs Goshs.
How do I fix CVE-2026-40903?
No fix has been published for CVE-2026-40903 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40903 being exploited?
There is no known exploitation of CVE-2026-40903 in the wild and no public exploit code.
Other vulnerabilities in patrickhener goshs
- CVE-2026-40884 goshs: Empty-username SFTP password authentication bypass in goshs
- CVE-2026-35392 goshs has an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs PUT Upload
- CVE-2026-35393 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs POST multipart upload
- CVE-2026-35471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs
- CVE-2026-40189 goshs has a file-based ACL authorization bypass in goshs state-changing routes
Sources
Also known as GHSA-hpxj-9fgp-fhhf.