CVE-2026-46699: conda-smithy GitHub Username Takeover Leading to Unauthorized Repository Access

Technical summary

The vulnerability exploits a fundamental design flaw in how conda-smithy's automated webservices handle repository invitation routing within conda-forge infrastructure. Rather than using immutable GitHub user IDs (which remain constant regardless of username changes), the system relies on mutable GitHub usernames as routing identifiers. GitHub's username reassignment policy means that after an account is deleted, the username becomes available for reuse by other users. An attacker could register or claim a previously used username associated with a repository invitation, allowing them to receive and accept invitations intended for the original user. This grants the attacker write access to feedstock repositories, enabling code injection into package build pipelines. The CVSS 3.1 score of 7.6 (HIGH) reflects the network-accessible nature of the attack, the requirement for user interaction (accepting an invitation), and the significant integrity impact, though confidentiality and availability impacts are limited to the immediate context of the compromised repository.

Business impact

Feedstock repositories in conda-forge are critical infrastructure for the Python and scientific computing ecosystem. Write access to these repositories enables attackers to inject malicious code into package build processes, potentially affecting millions of downstream users who install compromised packages. Beyond direct supply chain contamination, successful exploitation could damage the reputation and trust of conda-forge as a whole, undermine confidence in open-source CI/CD automation, and create liability for organizations whose packages or environments are affected. Organizations heavily invested in conda-based workflows—particularly in data science, machine learning, and scientific research—face elevated risk if their maintainers' accounts are compromised through this vector.

Affected systems

conda-smithy versions prior to 3.61.0 are affected. The vulnerability exists in the conda-forge automated webservices infrastructure that uses conda-smithy for repository and CI management. Any organization or project maintaining a feedstock repository within conda-forge and using conda-smithy versions before 3.61.0 could be targeted. The attack surface includes all conda-forge contributors and maintainers whose usernames could potentially be registered or reassigned.

Exploitability

Exploitability requires several conditions to align: the attacker must identify a target repository, obtain knowledge of or wait for a username associated with that repository to become available (either through voluntary account deletion or natural reassignment after GitHub's waiting period), successfully register or claim that username, and then position themselves to receive the repository invitation. While these steps require planning and patience, the barrier to execution is not prohibitively high for a motivated attacker. The attack does not require sophisticated technical capability, though it does require social engineering awareness or monitoring of username availability. The requirement for user interaction (acceptance of the invitation) is a minor friction point but does not significantly hinder exploitation if the attacker controls the username.

Remediation

Upgrade conda-smithy to version 3.61.0 or later immediately. This version remedies the vulnerability by implementing immutable GitHub user IDs as the basis for invitation routing, eliminating the username reassignment attack vector. Organizations should prioritize this upgrade for all systems managing conda-forge feedstock repositories. After upgrading, conduct an audit of recent repository access logs and invitation history to detect any unauthorized access or suspicious activity during the vulnerability window.

Patch guidance

Apply conda-smithy version 3.61.0 or any subsequent release. Verify the patch through conda-forge documentation or the conda-smithy GitHub repository. For deployment pipelines, test the upgrade in a staging environment to ensure compatibility with existing feedstock build configurations before rolling out to production systems. Given the supply-chain sensitivity of this component, consider prioritizing rapid patching across all conda-forge infrastructure.

Detection guidance

Review repository access logs and audit trails for invitations routed to usernames that were recently created, changed, or reassigned. Examine the history of contributors and their GitHub usernames—if you notice a username change coinciding with new repository access grants, investigate immediately. Monitor for unexpected commits or build configuration changes in feedstock repositories following username changes of collaborators. Check conda-smithy logs for anomalies in invitation acceptance patterns. Consider implementing additional authentication checks or approval workflows for repository access changes within your local conda-forge deployment.

Why prioritize this

This vulnerability merits immediate attention due to its direct impact on supply-chain integrity. conda-forge is foundational infrastructure for the Python ecosystem, and compromised feedstock repositories could distribute malicious packages to millions of users. The attack vector, while requiring some preparation, is not technically complex and becomes increasingly practical as time passes and usernames become available through natural account churn. Organizations maintaining critical packages or relying on conda as a core deployment vector should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 7.6 (HIGH) reflects: network accessibility (AV:N) with no special network access required; low attack complexity (AC:L) once a username is obtained; no privilege requirement (PR:N); but requires user interaction (UI:R) to accept the invitation. The integrity impact is rated HIGH because successful exploitation grants write access to critical package build infrastructure. Confidentiality and availability impacts are rated LOW in the context of the immediate attack, though downstream impact could be severe if malicious code is successfully injected into packages. The score appropriately captures the serious but conditional nature of this threat.

Frequently asked questions