Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "ndaal-madr-validate v0.4.0 ships with the GitHub Actions CI workflow `.github/workflows/ci.yaml` (commit 710ac0b07) hardened against four classes of supply-chain and credential-handling weaknesses identified by warden (CI/CD-specific static analyser): (1) four third-party actions previously referenced by mutable tag (`@v4`, `@stable`, `@v2`, `@v3`) are now pinned to full 40-character commit SHAs with the original tag preserved as a trailing comment for renovate / dependabot; (2) `actions/checkout` now sets `persist-credentials: false`, preventing GITHUB_TOKEN from remaining in the local git config after checkout where subsequent untrusted steps could exfiltrate it; (3) the `permissions:` block grows inline justification comments for both `contents: read` and `security-events: write` so reviewers can spot scope creep at a glance; (4) a `concurrency:` block with `cancel-in-progress: true` is added so superseded runs on the same branch / PR no longer race each other or upload conflicting SARIF artefacts. Verification: re-running `warden scan .` after the fix reports 'No security issues found.' (was 7 findings: 2 HIGH, 3 MEDIUM, 2 INFO).",
"title": "Summary"
},
{
"category": "description",
"text": "Four warden rules fired against `.github/workflows/ci.yaml` at commit 710ac0b07. Each is addressed by the post-fix workflow now in the working tree.\n\n1. WRD-311 — Unpinned action (×4; 2 HIGH, 2 MEDIUM):\n\n GitHub Actions resolves `uses:` references by name; a mutable tag (`@v4`) or branch (`@stable`) re-points whenever the upstream author force-pushes the tag or rotates the branch. An attacker who compromises the upstream action's repository — or who is the upstream author — can therefore inject arbitrary code into every downstream workflow run on the next CI invocation without modifying the consumer's source tree. This is the same threat model as the September 2023 `tj-actions/changed-files` retag and the March 2025 `reviewdog/action-setup` chain incident. Mitigation per GitHub's official guidance: pin to the full 40-character commit SHA, which is content-addressed and cannot be silently rotated.\n\n Pre-fix references (all four refer to mutable refs):\n actions/checkout@v4\n dtolnay/rust-toolchain@stable\n Swatinem/rust-cache@v2\n github/codeql-action/upload-sarif@v3\n\n Post-fix references (all four refer to immutable commit SHAs; the trailing `# vN` comment names the tag the SHA resolved to at pin time so renovate / dependabot can keep the pin moving):\n actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (resolved 2026-05-19)\n dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable (resolved 2026-05-19)\n Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 (resolved 2026-05-19, annotated-tag dereferenced to commit)\n github/codeql-action/upload-sarif@458d36d7d4f47d0dd16ca424c1d3cda0060f1360 # v3 (resolved 2026-05-19, annotated-tag dereferenced to commit)\n\n The `actions/*` and `github/*` namespaces are first-party (GitHub-owned), but warden flags them at MEDIUM because tag mutability is a property of the protocol, not of any specific publisher. The two `dtolnay/*` and `Swatinem/*` references are flagged HIGH because they are independent maintainers.\n\n2. WRD-730 — Checkout without persist-credentials: false (MEDIUM):\n\n `actions/checkout` by default writes the GITHUB_TOKEN into the local `.git/config` file as the credential for the `origin` remote so subsequent `git fetch` / `git push` steps work without further configuration. The token has the workflow's `permissions:` scopes (in this workflow: `contents: read`, `security-events: write`). When subsequent steps execute untrusted code — directly via a third-party action, transitively via `cargo install` or `npm install`, or via a release-time script that reads files under `.git/` — the token can be exfiltrated and used to push to the repository (for `contents: write`-scoped workflows) or to publish forged SARIF results (this workflow). Setting `persist-credentials: false` instructs checkout to remove the credential header from the config after the clone completes; nothing in `cargo build`, `cargo test`, or the SARIF upload step needs git push access.\n\n3. WRD-840 — Permission entry without documentation (INFO):\n\n The `permissions:` block listed `contents: read` and `security-events: write` without explaining why each scope is needed. Without that context, a future maintainer cannot tell whether a scope is still required or was inherited from a copy-paste, which biases reviewers toward keeping over-broad permissions. The post-fix workflow annotates each entry inline (`# checkout the repository tree` / `# required for github/codeql-action/upload-sarif`) and adds a header comment naming the principle (\"Least-privilege token scopes\").\n\n4. WRD-842 — Workflow lacks a concurrency block (INFO):\n\n Without a `concurrency:` group, two pushes to the same PR queue two complete `ci.yaml` runs. The second run wastes runner minutes finishing work that the first run already obsoleted, and — more concretely for this workflow — both runs upload `madr-report.sarif` to the same GitHub Code Scanning category (`ndaal-madr-validate`), where the later upload silently replaces the earlier one in non-deterministic order. Adding `concurrency: { group: ci-${{ github.workflow }}-${{ github.ref }}, cancel-in-progress: true }` cancels the older run as soon as a newer push lands, so the SARIF artefact on Code Scanning always reflects the latest commit and runner-minute consumption drops on busy PRs.\n\nNot a runtime vulnerability in the shipped `ndaal-madr-validate` binary. All four findings concern the CI/CD pipeline that builds the binary, not the binary itself. The threat surface is the GitHub Actions runner and the GITHUB_TOKEN scoped to this repository.\n\nVerification:\n warden scan . No security issues found. (was 7 findings)\n cargo build --locked Finished `dev` profile [unoptimized + debuginfo] target(s) in 4m 19s\n cargo test --all-targets --locked 81 passed; 0 failed (40 unit + 20 integration + 4 property + 4 snapshot + 13 upstream-deps)\n YAML syntax round-trip via `python3 -c \"import yaml,sys; yaml.safe_load(open('.github/workflows/ci.yaml'))\"` OK",
"title": "Description"
},
{
"category": "details",
"text": "Working tree (uncommitted at advisory issuance) on branch main of https://gitlab.com/vPierre/ndaal_public_madr_validate :\n\n .github/workflows/ci.yaml +18 / -4 lines (4 action references pinned to SHAs, `persist-credentials: false` added to checkout, `concurrency:` block added, permission comments added)\n\nWarden rule references (each rule has a stable identifier, full description in the warden rule catalogue at `warden rules`):\n\n WRD-311 Unpinned action OWASP CICD-SEC-3 (Inadequate Identity & Access Management) + CWE-1357 (Reliance on Insufficiently Trustworthy Component)\n WRD-730 Checkout without persist-credentials: false (latent leak) CWE-522 (Insufficiently Protected Credentials) + CWE-200 (Exposure of Sensitive Information)\n WRD-840 Permission entry without documentation CWE-1059 (Insufficient Technical Documentation) — process-hygiene\n WRD-842 Workflow lacks a concurrency block CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronisation) — race on SARIF artefact upload\n\nCommit-SHA resolution evidence (preserved here so reviewers can re-derive the pins):\n\n curl -sS https://api.github.com/repos/actions/checkout/git/ref/tags/v4 -> object.sha = 34e114876b0b11c390a56381ad16ebd13914f8d5 (commit)\n curl -sS https://api.github.com/repos/dtolnay/rust-toolchain/branches/stable -> commit.sha = 29eef336d9b2848a0b548edc03f92a220660cdb8\n curl -sS https://api.github.com/repos/Swatinem/rust-cache/git/ref/tags/v2 -> object.sha = 42dc69e1aa15d09112580998cf2ef0119e2e91ae (annotated tag)\n curl -sS https://api.github.com/repos/Swatinem/rust-cache/git/tags/42dc69e… -> object.sha = e18b497796c12c097a38f9edb9d0641fb99eee32 (commit)\n curl -sS https://api.github.com/repos/github/codeql-action/git/ref/tags/v3 -> object.sha = 78ed0c7291d93e40c51b085850dc669a4c3ab73b (annotated tag)\n curl -sS https://api.github.com/repos/github/codeql-action/git/tags/78ed0c7… -> object.sha = 458d36d7d4f47d0dd16ca424c1d3cda0060f1360 (commit)\n\nThreat surface covered:\n\n CWE-1357 — Reliance on Insufficiently Trustworthy Component (mutable action tags)\n CWE-522 — Insufficiently Protected Credentials (persisted GITHUB_TOKEN)\n CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor (same)\n CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronisation (SARIF upload race)\n CWE-1059 — Insufficient Technical Documentation (undocumented permission scopes)\n\nFollow-on hygiene already in place: renovate.json is configured at repo root, so the freshly pinned SHAs will be bumped automatically as upstream releases new tags.",
"title": "Files, warden rules, and threat coverage"
},
{
"category": "general",
"text": "Recommended action for downstream consumers of `ndaal-madr-validate` (binary, library, or deb package): none required. These findings concern the build-time CI pipeline, not the shipped artefacts. Operators do not need to upgrade, re-deploy, or change any runtime configuration.\n\nRecommended action for forks / mirrors of this repository:\n\n 1. Apply the same four mitigations to your fork's `.github/workflows/ci.yaml` — the GITHUB_TOKEN in your fork is yours, not ours, and the same exfiltration / supply-chain class applies.\n 2. If you maintain other workflows beyond `ci.yaml`, run `warden scan .` against each and apply the analogous fixes. Many of the rules (WRD-311 in particular) generalise.\n 3. Configure renovate (already present) or dependabot to track the pinned SHAs. Without one of these, the pins will go stale; warden does not flag a stale-but-pinned SHA, which is the intended trade-off — security review at bump time is preferable to silent re-pointing.\n\nRecommended action for contributors planning new workflows:\n\n 1. Pin every `uses:` reference to a full 40-character commit SHA at the first commit. Use the GitHub REST API (`/repos/{owner}/{repo}/git/ref/tags/{tag}` + dereference for annotated tags) to resolve a tag to its commit SHA.\n 2. Set `persist-credentials: false` on every `actions/checkout` step unless a later step in the same job explicitly needs `git push`.\n 3. Add a `concurrency:` block with `cancel-in-progress: true` to every workflow whose later steps upload artefacts to a shared sink (SARIF, package registries, container registries).\n 4. Document every entry under `permissions:` with an inline comment naming the consuming step.",
"title": "Recommended action"
},
{
"category": "other",
"text": "Disposition: security advisory — defensive hardening of the CI/CD pipeline, no runtime impact on shipped binaries. Severity rolled up to MEDIUM (the most severe component finding was WRD-311 HIGH, but the realistic exploit surface is limited to the repository's own CI runner with a `contents: read` + `security-events: write` token, so the cross-repository impact is bounded). Status final.",
"title": "Disposition"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_madr_validate/-/raw/main/csaf/2026/046/ndaal-sa-2026-046.json"
},
{
"category": "external",
"summary": "warden CI/CD static analyser (rule catalogue: `warden rules`)",
"url": "https://github.com/woodruffw/zizmor"
},
{
"category": "external",
"summary": "GitHub Actions security hardening guide — pin actions to a full-length commit SHA",
"url": "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"
},
{
"category": "external",
"summary": "GitHub Actions checkout — persist-credentials input documentation",
"url": "https://github.com/actions/checkout#usage"
},
{
"category": "external",
"summary": "GitHub Actions — using concurrency to cancel in-progress runs",
"url": "https://docs.github.com/en/actions/using-jobs/using-concurrency"
},
{
"category": "external",
"summary": "OWASP Top 10 CI/CD Security Risks — CICD-SEC-3: Inadequate Identity & Access Management",
"url": "https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-03"
},
{
"category": "external",
"summary": "CWE-1357 — Reliance on Insufficiently Trustworthy Component",
"url": "https://cwe.mitre.org/data/definitions/1357.html"
},
{
"category": "external",
"summary": "CWE-522 — Insufficiently Protected Credentials",
"url": "https://cwe.mitre.org/data/definitions/522.html"
},
{
"category": "external",
"summary": "CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor",
"url": "https://cwe.mitre.org/data/definitions/200.html"
},
{
"category": "external",
"summary": "CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronisation",
"url": "https://cwe.mitre.org/data/definitions/362.html"
},
{
"category": "external",
"summary": "CWE-1059 — Insufficient Technical Documentation",
"url": "https://cwe.mitre.org/data/definitions/1059.html"
},
{
"category": "external",
"summary": "ndaal-madr-validate README",
"url": "https://gitlab.com/vPierre/ndaal_public_madr_validate/-/raw/main/README.md"
}
],
"title": "ndaal Security Advisory: GitHub Actions CI workflow hardening — pin third-party actions to commit SHAs, persist-credentials: false, concurrency block, permission documentation (warden WRD-311 / WRD-730 / WRD-840 / WRD-842)",
"tracking": {
"current_release_date": "2026-05-19T00:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-046",
"initial_release_date": "2026-05-19T00:00:00.000Z",
"revision_history": [
{
"date": "2026-05-19T00:00:00.000Z",
"number": "1.0.0",
"summary": "Initial security advisory documenting the GitHub Actions CI workflow hardening that resolves seven warden findings against `.github/workflows/ci.yaml` at commit 710ac0b07 (2 HIGH + 3 MEDIUM + 2 INFO): four `uses:` references pinned from mutable tags / branches to full commit SHAs (WRD-311), `actions/checkout` configured with `persist-credentials: false` (WRD-730), inline justification comments added to each `permissions:` entry (WRD-840), and a `concurrency:` block with `cancel-in-progress: true` added to prevent superseded runs from racing on SARIF upload (WRD-842). Post-fix `warden scan .` reports 'No security issues found.' Status: final."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "ndaal-madr-validate",
"branches": [
{
"category": "product_version",
"name": "0.4.0-pre-warden-fix",
"product": {
"name": "ndaal-madr-validate 0.4.0 CI workflow at commit 710ac0b07 — `.github/workflows/ci.yaml` references four third-party actions by mutable tag or branch (actions/checkout@v4, dtolnay/rust-toolchain@stable, Swatinem/rust-cache@v2, github/codeql-action/upload-sarif@v3), persists GITHUB_TOKEN in local git config after checkout, `permissions:` entries lack inline justification, and no `concurrency:` block is present so superseded runs race on the shared `ndaal-madr-validate` SARIF Code-Scanning category",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.4.0-post-warden-fix",
"product": {
"name": "ndaal-madr-validate 0.4.0 CI workflow after the warden remediation — `.github/workflows/ci.yaml` pins all four third-party actions to full 40-character commit SHAs with the original tag preserved as a trailing comment for renovate / dependabot, `actions/checkout` sets `persist-credentials: false`, each `permissions:` entry carries an inline justification comment, and a `concurrency:` block with `cancel-in-progress: true` prevents superseded runs from racing on the shared SARIF Code-Scanning category. Post-fix `warden scan .` reports 'No security issues found.'",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"notes": [
{
"category": "description",
"text": "Four `uses:` references in `.github/workflows/ci.yaml` resolved against mutable refs: actions/checkout@v4 and github/codeql-action/upload-sarif@v3 (GitHub first-party, MEDIUM), dtolnay/rust-toolchain@stable and Swatinem/rust-cache@v2 (independent maintainers, HIGH). An upstream tag re-point or branch rotation — accidental or malicious — would silently change the code that runs in this workflow on the next CI invocation. Same threat class as the September 2023 `tj-actions/changed-files` retag incident.",
"title": "Description"
},
{
"category": "details",
"text": "Mitigation: each reference now uses a full 40-character commit SHA with the original tag preserved as a trailing comment so renovate / dependabot can keep the pin moving without losing the semantic version anchor.",
"title": "Mitigation"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "none_available",
"details": "No fix is available for the affected workflow state (CSAFPID-0001); the pre-warden-fix `.github/workflows/ci.yaml` carries this finding. Adopt the post-warden-fix workflow (CSAFPID-0002) to remediate.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Pin every `uses:` reference to a full 40-character commit SHA. The fix is in the working tree of branch main; apply by adopting the post-fix `.github/workflows/ci.yaml` (CSAFPID-0002).",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "Mutable action references in CI workflow (warden WRD-311)",
"references": [
{
"category": "external",
"summary": "GitHub Actions security hardening — pin actions to a full-length commit SHA",
"url": "https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions"
},
{
"category": "external",
"summary": "OWASP CICD-SEC-3 — Inadequate Identity & Access Management",
"url": "https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-03"
}
]
},
{
"notes": [
{
"category": "description",
"text": "`actions/checkout` by default writes GITHUB_TOKEN into the local `.git/config` as the credential for the `origin` remote. Subsequent steps that execute untrusted code (third-party actions, transitive package-manager invocations, release scripts that read files under `.git/`) can exfiltrate the token, which carries this workflow's `contents: read` + `security-events: write` scopes. Setting `persist-credentials: false` removes the credential header after the clone completes; no later step in this workflow needs git push access.",
"title": "Description"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "none_available",
"details": "No fix is available for the affected workflow state (CSAFPID-0001); the pre-warden-fix `.github/workflows/ci.yaml` carries this finding. Adopt the post-warden-fix workflow (CSAFPID-0002) to remediate.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Add `with: { persist-credentials: false }` to the `actions/checkout` step.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "GITHUB_TOKEN persisted in local git config after checkout (warden WRD-730)",
"references": [
{
"category": "external",
"summary": "actions/checkout README — persist-credentials input",
"url": "https://github.com/actions/checkout#usage"
},
{
"category": "external",
"summary": "CWE-522 — Insufficiently Protected Credentials",
"url": "https://cwe.mitre.org/data/definitions/522.html"
}
]
},
{
"notes": [
{
"category": "description",
"text": "Two pushes to the same PR queued two complete `ci.yaml` runs. Both runs uploaded `madr-report.sarif` to the same GitHub Code Scanning category (`ndaal-madr-validate`); the later upload silently replaced the earlier one in non-deterministic order. In addition to wasting runner minutes, this could surface a stale SARIF report on the PR if the older run finished second.",
"title": "Description"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "none_available",
"details": "No fix is available for the affected workflow state (CSAFPID-0001); the pre-warden-fix `.github/workflows/ci.yaml` carries this finding. Adopt the post-warden-fix workflow (CSAFPID-0002) to remediate.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Add a top-level `concurrency:` block keyed on `ci-${{ github.workflow }}-${{ github.ref }}` with `cancel-in-progress: true`.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "Workflow lacks concurrency control on shared SARIF upload sink (warden WRD-842)",
"references": [
{
"category": "external",
"summary": "GitHub Actions — using concurrency to cancel in-progress runs",
"url": "https://docs.github.com/en/actions/using-jobs/using-concurrency"
}
]
},
{
"notes": [
{
"category": "description",
"text": "The `permissions:` block declared `contents: read` and `security-events: write` without explaining the consuming step. Process-hygiene risk: future maintainers cannot tell whether each scope is still required or was inherited from a copy-paste, which biases reviewers toward keeping over-broad permissions. Mitigation: each entry now carries an inline `# why` comment naming the consuming step.",
"title": "Description"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "none_available",
"details": "No fix is available for the affected workflow state (CSAFPID-0001); the pre-warden-fix `.github/workflows/ci.yaml` carries this finding. Adopt the post-warden-fix workflow (CSAFPID-0002) to remediate.",
"product_ids": [
"CSAFPID-0001"
]
},
{
"category": "vendor_fix",
"details": "Document each entry under `permissions:` with an inline comment naming the consuming step.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"baseScore": 0.0,
"baseSeverity": "NONE",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "Permission scopes lack inline justification (warden WRD-840)",
"references": [
{
"category": "external",
"summary": "CWE-1059 — Insufficient Technical Documentation",
"url": "https://cwe.mitre.org/data/definitions/1059.html"
}
]
}
]
}