{ "document": { "acknowledgments": [ { "organization": "CISA", "summary": "reported these vulnerabilities" } ], "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage" } }, "lang": "en-US", "notes": [ { "category": "other", "text": "United States", "title": "Countries/areas deployed" }, { "category": "other", "text": "None", "title": "Critical infrastructure sectors" }, { "category": "general", "text": "government.github.com F-01: First scanned 2026-07-12; re-validated 2026-09-10.", "title": "Scan provenance" }, { "category": "general", "text": "government.github.com F-01: Informational/Hardening — no direct exploitable impact; CVSS 4.0 score 0.0 (all-None base vector). Included for completeness of the full findings corpus.", "title": "Classification" }, { "category": "summary", "text": "government.github.com F-01: F-01 · Info · Stale contribution fork of `github/government.github.com`; zero SSA-authored code; all scanner output upstream-owned", "title": "Finding summary" }, { "category": "legal_disclaimer", "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).", "title": "Legal Notice and Terms of Use" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolating them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.", "title": "Recommended Practices" }, { "category": "general", "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:", "title": "Recommended Practices" }, { "category": "general", "text": "Do not click web links or open attachments in unsolicited email messages.", "title": "Recommended Practices" }, { "category": "general", "text": "Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.", "title": "Recommended Practices" }, { "category": "general", "text": "Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.", "title": "Recommended Practices" }, { "category": "general", "text": "No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.", "title": "Recommended Practices" } ], "publisher": { "category": "coordinator", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "external", "summary": "Affected repository (reviewed commit)", "url": "https://github.com/SSAgov/government.github.com/tree/0580274c3d727e488340fcb66885a5eeeed3e076" }, { "category": "self", "summary": "VA Advisory VA-26-314-02 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-314-02.json" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b" } ], "title": "Social Security Administration government.github.com", "tracking": { "current_release_date": "2026-11-10T06:00:00.000000Z", "generator": { "date": "2026-11-05T19:36:43.743468Z", "engine": { "name": "CISA CSAF Generator", "version": "2.0.0" } }, "id": "VA-26-314-02", "initial_release_date": "2026-11-10T06:00:00.000000Z", "revision_history": [ { "date": "2026-11-10T06:00:00.000000Z", "number": "1", "summary": "Initial Publication" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "commit_0580274c3d727e488340fcb66885a5eeeed3e076", "product": { "name": "SSAgov government.github.com commit_0580274c3d727e488340fcb66885a5eeeed3e076", "product_id": "CSAFPID-0001" } } ], "category": "product_name", "name": "government.github.com" } ], "category": "vendor", "name": "SSAgov" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-104374", "cwe": { "id": "CWE-1104", "name": "Use of Unmaintained Third Party Components" }, "notes": [ { "category": "summary", "text": "The repository is SSA's 2018 fork of GitHub Inc.'s `github/government.github.com` marketing site, created solely to contribute a data-list entry upstream. SSA's total contribution — six commits, all from `open.source@ssa.gov` on 2018-07-27, verified against the git history at the reviewed commit:\n\n```diff\n# 32a9f1e / ae54031 — _data/governments.yml (\"U.S. Federal\" section)\n+ - SSAgov\n# f0885ce / a295d10 — _data/governments.yml (dead-link removal)\n- - OntarioDigital\n# d00a9a9 — _data/civic_hackers.yml (dead-link removal)\n- - spendb\n# b2af669 — _data/research.yml (dead-link removal)\n- - scalability-llnl\n```\n\nThe reviewed commit `0580274` is a merge authored from a `github.com` maintainer address on 2018-07-31, combining SSA's contribution branch (`patch-1`) with the then-current upstream branch; the last push was 2018-08-01 and the repository has been dormant since. No SSA-authored code, configuration, workflow, hostname, or secret exists anywhere in it. Of the eight branches, `patch-1` is SSA's contribution branch (YAML edits only) and the other six non-default branches are upstream feature branches inherited at fork time, authored 2015–2018 from non-SSA addresses.\n\nBecause the repository is a 2018 snapshot of a third-party (GitHub Inc.) codebase whose only surviving SSA-authored content is one YAML list line (`_data/governments.yml:701`, confirmed by blame), static-analysis, dependency, and secret-scan results it produces are upstream-attributable — see *Not filed* for the full disposition of all 33 scanner results. None represents an SSA vulnerability. The repository also is not deployed: `CNAME` names `government.github.com`, a GitHub-owned domain already bound to the upstream repository's own Pages deployment, and GitHub Pages will not bind the same custom domain to a second repository.\n\nFiled as Informational because dormant contribution forks under an agency GitHub organization create recurring false-positive load on organization-wide security scanning and expose the agency to supply-chain-alert fatigue for code it neither wrote nor operates.\n\nAdditional affected files (entire file): N/A — Informational", "title": "Vulnerability Summary" }, { "category": "details", "text": "SSVCv2/E:N/A:N/TI:P/U:N/2026-10-01T23:09:03.265704Z", "title": "SSVC" } ], "product_status": { "known_affected": [ "CSAFPID-0001" ] }, "references": [ { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2026-104374" }, { "category": "external", "summary": "cwe.mitre.org", "url": "https://cwe.mitre.org/data/definitions/1104.html" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N" }, { "category": "external", "summary": "www.first.org", "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N" } ], "remediations": [ { "category": "no_fix_planned", "details": "The government.github.com repository has been decommissioned as of 9/18/26.", "product_ids": [ "CSAFPID-0001" ] } ], "scores": [ { "cvss_v3": { "baseScore": 0.0, "baseSeverity": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N", "version": "3.1" }, "products": [ "CSAFPID-0001" ] } ] } ] }