A second path through the gh-aw credential gateway did not require the browser environment variable. The gateway removed an /api/v3 prefix and concatenated the remaining path onto the expected GitHub origin. When the remainder began with an at-sign, the URL parser interpreted api.github.com as user information rather than the hostname. The effective…
Case · DiggingBeagle record
gh-aw API proxy URL parsing forwarded job credentials to an external host
A malformed gh-aw API path changed the parsed request host while leaving an API credential attached, sending a job token to an attacker-controlled destination.
Scope
gh-aw API gateway reachable from a workflow sandbox before advisory patch; attacker needs an execution path inside the workflow. Demonstrated against researcher-controlled infrastructure and repository.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Impact
- Band 3 of 4
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
GHSA-9jxf-w4wc-5g93 confirms that URL concatenation parsed api.github.com as userinfo rather than origin and that the test token could perform authorized repository API effects from the wrong principal. Current advisory metadata marks 0.91.13 as patched, despite conflicting prose elsewhere. No cross-tenant or unrelated-victim exploitation is proven.
Impact basis: A sandbox-controlled request was forwarded to an attacker-controlled HTTPS origin with the privileged GitHub job token. The proof used that credential against a private test repository; attacker entry into an AWF sandbox was required.
Assessed Oct 19, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-GHAW-API-PROXY-USERINFO · GHSA-9jxf-w4wc-5g93: sandbox credential sidecar exfiltration
At a glance
The effect was credential forwarding by a trusted intermediary, independent of the GH_BROWSER environment override documented by the same advisory.
Read the implicationsThe proof does not demonstrate general cross-tenant compromise. The structured advisory patch version and remediation narrative disagree between v0.91.13 and v0.91.12, so the higher listed version is used as a conservative verification target.
Limits and uncertaintyFull account
A second path through the gh-aw credential gateway did not require the browser environment variable. The gateway removed an /api/v3 prefix and concatenated the remaining path onto the expected GitHub origin. When the remainder began with an at-sign, the URL parser interpreted api.github.com as user information rather than the hostname. The effective destination became the attacker-controlled host, while the gateway still attached the job's authentication.
The researcher verified both a received credential and its ability to read a private test repository and create an issue. Direct egress from the sandbox to the same endpoint was blocked, demonstrating why a proxy that holds trusted credentials must authorize its parsed final destination, not merely the input's apparent URL prefix. The case is separate from the CLI environment injection even though both were reported under the same advisory.
The disclosed scope is a per-workflow token and repository authority, not arbitrary GitHub platform access. Patch metadata and prose disagree on 0.91.12 versus 0.91.13, so the current deployed sidecar and its compiled workflow should be checked together. A fixed-target HTTP client must reconstruct the origin from trusted components, not concatenate attacker-supplied URL syntax.
Claims & evidence
CLM-GHAW-API-PROXY-USERINFOThe gh-aw MCP gateway URL construction allowed a malformed API path to become a URL whose effective host was an attacker-selected destination, with api.github.com parsed as user information.supported
Basis: reported finding
- supportsGHSA-9jxf-w4wc-5g93: sandbox credential sidecar exfiltrationprimary disclosure
Description, issue 2 malformed /api/v3 path; Resolution
Implications
The effect was credential forwarding by a trusted intermediary, independent of the GH_BROWSER environment override documented by the same advisory.
Controls and mitigations
- Parse and authorize the final URL origin, ensure credential attachment is restricted to the intended service, and test encoded delimiters after all transformations.
Unknowns and contradictions
- The proof does not demonstrate general cross-tenant compromise. The structured advisory patch version and remediation narrative disagree between v0.91.13 and v0.91.12, so the higher listed version is used as a conservative verification target.
Sources and citation
Material revision history
- Oct 19, 2026 · Published version · first publication · revision 174
- Oct 19, 2026 · Canonical change recorded · material revision · revision 175Public fields changed: assessment_profile