CVE-2026-58412 Details
Description
Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service. Prior to 1.1.0, the upload GitHub Action's fork detection in `upload-action/src/build.js` checks only `event.pull_request`. In the documented two-workflow pattern, an untrusted fork pull-request workflow produces an artifact and a privileged `workflow_run` workflow downloads and uploads it. Because `workflow_run` has no `event.pull_request`, `isForkPR` becomes false and `uploadStatus` becomes `pending-upload`. The action later resolves `workflow_run.pull_requests` without repeating the fork check before initializing the wallet with `walletPrivateKey` and uploading the artifact. An external contributor can therefore cause attacker-controlled artifacts to be stored using the repository owner's Filecoin wallet, incurring unauthorized storage expenditure, dataset pollution and consumption of configured wallet funds. Disclosure of the wallet private key is not required. The 0.x action line is not receiving a backport and must be migrated to a fixed 1.x release. This issue is fixed in version 1.1.0.
A vulnerability exists in the Filecoin Pin GitHub Action, specifically in versions prior to 1.1.0. The issue arises from the upload action's fork detection mechanism, which only checks for forked pull requests in standard 'pull_request' events. When a pull request from an untrusted fork is processed through a 'workflow_run' event, the action fails to recognize it as a fork, mistakenly allowing the upload to proceed. This can lead to unauthorized use of the repository owner's Filecoin wallet for storing attacker-controlled artifacts, causing unexpected storage costs and potential dataset contamination.
Users should upgrade to Filecoin Pin version 1.1.0 or later. For those using the GitHub Action, pin to 'filecoin-project/filecoin-pin/upload-action@v1', which tracks the latest 1.x release. If currently pinned to a v0.x release, migrate to v1, as the v0.x line will not receive this fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filecoin-project/filecoin-pin/commit/6fb9efd1796e64a3515dffaa45b262e03cbd197c | [email protected] | Source CodeVendor |
| https://github.com/filecoin-project/filecoin-pin/pull/588 | [email protected] | Issue TrackingVendor |
| https://github.com/filecoin-project/filecoin-pin/security/advisories/GHSA-4rpx-vcp4-863j | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/filecoin-project/filecoin-pin/tree/v1.1.0 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Filecoin Pin | <= 1.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |