CVE-2026-40903

CVE-2026-40903 is an ArtiPACKED vulnerability affecting goshs (a Go-based SimpleHTTPServer) versions prior to 2.0.0-beta.6, which allows unauthorized leakage of GITHUB_TOKEN credentials through workflow artifacts despite the token not being present in the repository source code. The vulnerability presents a critical security risk with a CVSS score of 9.1, characterized by a network-based attack vector requiring no authentication or user interaction, making it easily exploitable by remote threat actors. The attack can result in complete compromise of confidentiality and integrity of systems, as demonstrated by the ability to extract sensitive authentication tokens that could facilitate further unauthorized access or actions. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, and community attention remains minimal as reflected in the moderate FAUCET Risk Score of 52.0. Organizations running goshs versions prior to 2.0.0-beta.6 should prioritize immediate patching to mitigate the risk of credential exposure and potential lateral movement by attackers.