Edit ndaal-sa-2026-046

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

ndaal-madr-validate v0.4.0 ships with the GitHub Actions CI workflow `.github/workflows/ci.yaml` (commit 710ac0b07) hardened against four classes of supply-chain and credential-handling weaknesses identified by warden (CI/CD-specific static analyser): (1) four third-party actions previously referenced by mutable tag (`@v4`, `@stable`, `@v2`, `@v3`) are now pinned to full 40-character commit SHAs with the original tag preserved as a trailing comment for renovate / dependabot; (2) `actions/checkout` now sets `persist-credentials: false`, preventing GITHUB_TOKEN from remaining in the local git config after checkout where subsequent untrusted steps could exfiltrate it; (3) the `permissions:` block grows inline justification comments for both `contents: read` and `security-events: write` so reviewers can spot scope creep at a glance; (4) a `concurrency:` block with `cancel-in-progress: true` is added so superseded runs on the same branch / PR no longer race each other or upload conflicting SARIF artefacts.  Verification: re-running `warden scan .` after the fix reports 'No security issues found.' (was 7 findings: 2 HIGH, 3 MEDIUM, 2 INFO).

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel