Project

General

Profile

Actions
Copy link

SecOps #1286

open
CD

[Sécurité] Vulnérabilité de code : .github/workflows/match-build.yml:31 (yaml.github-actions.security.secrets-inherit.secrets-inherit)

SecOps #1286: [Sécurité] Vulnérabilité de code : .github/workflows/match-build.yml:31 (yaml.github-actions.security.secrets-inherit.secrets-inherit)

Added by Client Dashboard about 1 month ago. Updated 29 days ago.

Status:
Submitted
Priority:
Normal
Assignee:
-
Start date:
07/01/2026
Due date:
% Done:

0%

Estimated time:
spec_ref:
build_status:
build_number:
ci_run_url:
scan_status:
scan_report_url:
deploy_status:
preprod_url:
deployed_at:
branch:
pr_url:
security_key:
.github/workflows/match-build.yml:31_yaml.github-actions.security.secrets-inherit.secrets-inherit
severity:
high
paused:

Description

**Sévérité** : HIGH
**Source** : Semgrep
`vuln-high`
**Emplacement** : .github/workflows/match-build.yml:31
**Règle** : yaml.github-actions.security.secrets-inherit.secrets-inherit

This workflow uses `secrets: inherit` to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the `secrets:` map, e.g. `secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }`.

### Extrait de code
```
requires login
```

### Lien CVE
https://docs.github.com/en/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow

Actions
Copy link

Also available in: PDF Atom