CVE-2026-44246 Details
Description
nnU-Net is a semantic segmentation framework that automatically adapts its pipeline to a dataset. Prior to 2.4.1, the nnU-Net Issue Triage workflow in .github/workflows/issue-triage.yml is vulnerable to Agentic Workflow Injection. The workflow sets allowed_non_write_users: ${{ github.event.issue.user.login }}, which means any logged-in GitHub user who opens an issue can reach this agentic workflow with attacker-controlled content. Untrusted issue title and body content are embedded directly into the prompt of anthropics/claude-code-action, and the workflow then runs a command-capable Claude agent with permission to comment on and relabel the current issue via gh. Because this workflow is triggered automatically on issues.opened, an external attacker can submit a crafted issue that steers the agent beyond its intended issue-triage purpose and influences authenticated issue actions. This vulnerability is fixed in 2.4.1.
A vulnerability allowing agentic workflow injection has been identified in the nnU-Net semantic segmentation framework, specifically in the Issue Triage workflow of the GitHub repository MIC-DKFZ/nnUNet, prior to version 2.4.1. The issue arises because the workflow allows any logged-in GitHub user to inject untrusted content into a command-capable agent, which can then manipulate issue comments and labels. This exploitation is possible as the workflow automatically triggers on newly opened issues, creating a pathway for external attackers to influence repository management actions.
Users are advised to update to nnU-Net version 2.4.1 or later, and to avoid embedding raw issue content directly into the workflow's agent prompt. Instead, only the issue number should be passed, with content retrieved in a more controlled manner. All issue data should be treated as untrusted and clearly separated from operational instructions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/MIC-DKFZ/nnUNet/security/advisories/GHSA-63mx-j37w-gh59 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dkfz nnu-net | < 2.4.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |