GitHub to Block pull_request_target Workflows by Default on December 2, 2026

• •Starting December 2, 2026, GitHub will block pull_request_target workflows by default in public repositories.
• •The change aims to mitigate risks from executing untrusted code that could compromise sensitive data.
• •Repository administrators must explicitly allow the pull_request_target event for workflows to run.

GitHub will enforce a default block on pull_request_target workflows in public repositories starting December 2, 2026, to enhance security against CI/CD vulnerabilities. This change, initially announced in September 2026, aims to prevent attackers from exploiting these workflows to access sensitive credentials. The pull_request_target event allows workflows to run with elevated privileges, which can be dangerous if untrusted code is executed. GitHub's previous measures in June 2026 had already restricted unsafe fork checkouts, but the upcoming policy will block the event entirely unless explicitly allowed by repository administrators. The enforcement was postponed from an earlier date of November 2, 2026, providing maintainers additional time to adjust their workflows. Currently, the policy is in evaluation mode, allowing workflows to run while identifying potential impacts. This change follows warnings from researchers about vulnerabilities associated with pull_request_target since 2021.