Policy
GitHub to Block pull_request_target Workflows by Default Starting December 2
Socket · By Sarah Gooding ·
GitHub will begin blocking GitHub Actions workflows triggered by pull_request_target in public repositories on December 2, 2026, expanding its protections against a class of CI/CD vulnerabilities that has repeatedly enabled attackers to steal credentials and compromise open…
The Brief
- GitHub will begin blocking GitHub Actions workflows triggered by pull_request_target in public repositories on December 2, 2026.
- The change expands GitHub's existing protections against CI/CD vulnerabilities.
- Sources say this vulnerability class has repeatedly let attackers steal credentials and compromise repositories.
Why it matters
Public repositories whose workflows rely on pull_request_target will stop running by default after the change, so their CI pipelines may break unless they are reviewed and adjusted.
Who’s affected
- Maintainers of public GitHub repositories that use GitHub Actions
- Teams with workflows triggered by pull_request_target
What to do
- Review workflows that use pull_request_target before December 2, 2026
- #github-actions
- #ci-cd
- #github
- #security
- #supply-chain
Timeline
Socket
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub begins blocking pull_request_target workflows by default in public repositories
