SecOps #1275: [Sécurité] Vulnérabilité de code : .github/workflows/app-promote.yml:35 (yaml.github-actions.security.secrets-inherit.secrets-inherit) - GetYourJob - Redmine

Custom queries

Issues assigned to me
Reported issues
Updated issues
Watched issues

Actions

SecOps #1275

open

[Sécurité] Vulnérabilité de code : .github/workflows/app-promote.yml:35 (yaml.github-actions.security.secrets-inherit.secrets-inherit)

SecOps #1275: [Sécurité] Vulnérabilité de code : .github/workflows/app-promote.yml:35 (yaml.github-actions.security.secrets-inherit.secrets-inherit)

Added by Client Dashboard about 1 month ago. Updated 12 days ago.

Status:

Submitted

Priority:

Normal

Assignee:

Start date:

07/01/2026

Due date:

% Done:

Estimated time:

spec_ref:

build_status:

build_number:

ci_run_url:

scan_status:

scan_report_url:

deploy_status:

preprod_url:

deployed_at:

branch:

pr_url:

security_key:

.github/workflows/app-promote.yml:35_yaml.github-actions.security.secrets-inherit.secrets-inherit

severity:

high

paused:

Description

**Sévérité** : HIGH
**Source** : Semgrep
`vuln-high`
**Emplacement** : .github/workflows/app-promote.yml:35
**Règle** : yaml.github-actions.security.secrets-inherit.secrets-inherit

This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`.

### Extrait de code
```
requires login
```

### Lien CVE
https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow

History
Notes