Exploitation of GitHub Actions via pull_request_target Trigger

A targeted campaign exploiting GitHub Actions' pull_request_target trigger was identified, allowing attackers to execute malicious code with elevated privileges. This vulnerability has been documented since 2021 but continues to be misconfigured in many repositories. The hackerbot-claw account scanned public repositories for these misconfigurations, submitting malicious pull requests to high-profile targets, including Microsoft and DataDog projects. Between February 21 and March 2, 2026, this campaign demonstrated the feasibility of such attacks at scale. GitHub has implemented platform-level mitigations, but many users still rely on insecure configurations. The ongoing prt-scan campaign indicates that this attack vector is evolving and may become accessible to a broader range of actors. Security professionals are urged to review their GitHub Actions configurations to mitigate risks.

Key Points: • The pull_request_target trigger in GitHub Actions allows elevated access to repository secrets. • A campaign by hackerbot-claw exploited this vulnerability, targeting high-profile repositories. • Despite GitHub's mitigations, misconfigurations remain common, posing ongoing risks.