Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

Security researchers at Noma Security have uncovered a concerning vulnerability in GitHub Agentic Workflows that could allow attackers to leak sensitive information from private repositories. This discovery highlights a significant risk for organizations relying on these automated workflows to manage their codebase operations, particularly when those workflows have been granted extensive access privileges.

The vulnerability works through a deceptively simple attack vector. An attacker with no credentials or organizational access whatsoever can create what appears to be a normal issue on a public GitHub repository. If the organization has configured their Agentic Workflows with read access across all repositories—including private ones—this public issue can trigger the workflow to inadvertently leak private repository data back to the attacker. This attack requires minimal technical expertise and bypasses traditional security controls that would typically prevent unauthorized access to private code repositories.

Organizations utilizing GitHub Agentic Workflows with broad repository permissions are potentially vulnerable to this attack. The risk is particularly acute for enterprises that house sensitive code, intellectual property, or security credentials in their private repositories. What makes this vulnerability especially concerning is its stealthy nature; the attack leaves minimal footprints and requires no sophisticated hacking techniques or stolen credentials.

For security teams, this discovery necessitates an immediate review of GitHub Agentic Workflow permissions. Organizations should adopt the principle of least privilege by restricting workflow access to only those repositories absolutely necessary for their function. Additionally, security teams should implement monitoring to detect any unusual behavior from their Agentic Workflows, particularly unexpected data retrieval or exposure patterns. Consideration should also be given to segmenting sensitive code into separate repositories with strictly controlled access.

Key Takeaways: The Noma Security research reveals that GitHub Agentic Workflows can be manipulated through public issues to expose private repository contents when configured with overly permissive access. Organizations must reevaluate their workflow permissions immediately, implementing strict access controls and monitoring to prevent unauthorized data disclosure. This vulnerability serves as a reminder that even legitimate automation tools can create unexpected security risks when granted excessive privileges