{"vulnerability": "CVE-2026-46600", "sightings": [{"uuid": "652871a6-f923-4cb0-a831-a1227db5dcb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46600", "type": "seen", "source": "https://gist.github.com/sherine-k/eeebb5de0dc45167d6be9ddd7b51d2ef", "content": "# Automating VEX Triage for a Go Project with Vexflow\n[Vexflow](https://github.com/carabiner-dev/vexflow) is a CLI tool that manages the lifecycle of VEX (Vulnerability Exploitability eXchange) data through GitHub issues. It scans your code for vulnerabilities, opens triage issues, lets maintainers assess impact via slash commands, and publishes signed OpenVEX attestations.\n\nI set it up on [sherine-k/gophers-api](https://github.com/sherine-k/gophers-api) (a fork of [scraly/gophers-api](https://github.com/scraly/gophers-api)) to see the full flow in action: scan, triage, assess, and attest.\n\n## What you need\n- A code repository to scan (Go ecosystem supported)\n- A triage repository where vexflow manages issues and stores attestations\n- A GitHub Actions workflow in the code repository\n- An OWNERS file in the triage repository listing authorized approvers\n\n## Step 1: Create the triage repository\n\nI created [sherine-k/.vexflow](https://github.com/sherine-k/.vexflow) as a public repository. This is where vexflow opens triage issues and publishes VEX attestations.\n\nAlthough Vexflow's [README](https://github.com/carabiner-dev/vexflow/blob/main/README.md) suggests the repository can stay private, I was not able to make the GitHub Actions workflow read from that repository unless it was public. (Issue to be open)\n\nThe name .vexflow is the convention that vexflow uses by default. You can change that by using the `--triage-repo` flag.\n\nAt the root of this repository, I added an OWNERS file:\n```\napprovers:\n  - sherine-k\n```\n\nOnly users listed under approvers can issue slash commands. \n\n## Step 2: Create a fine-grained secret\n\nUnder my GitHub account (on the top right), I went to Settings -> Credentials -> Fine-grained personal access tokens. \n\nI created a token there with permissions on 2 repositories only ([sherine-k/gophers-api](https://github.com/sherine-k/gophers-api) and [sherine-k/.vexflow](https://github.com/sherine-k/.vexflow)), with :\n* _Read access to code_\n* _Read access to metadata_ (default)\n* _Read **and write** access to attestations api_\n* _Read **and write** access to issues_\n\nUnder [sherine-k/gophers-api](https://github.com/sherine-k/gophers-api) -> Settings -> Secrets and variables -> Actions, I created a new secret, `VEXFLOW_TOKEN`, and I pasted in the token value.\nThis is what will allow vexflow to scan the gophers-api source code, and create and update issues in the .vexflow repository.\n\n## Step 3: Add the GitHub Actions workflow\n\nIn [sherine-k/gophers-api](https://github.com/sherine-k/gophers-api), I created .github/workflows/vexflow.yml:\n```yaml\nname: VEX Triage\n\non:\n  push:\n    branches: [main]\n  schedule:\n    - cron: '0 */6 * * *'\n  workflow_dispatch:\n\npermissions:\n  contents: read\n  issues: write\n  id-token: write\n  attestations: write\n\njobs:\n  vexflow-update:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Set up Go\n        uses: actions/setup-go@v5\n        with:\n          go-version: '1.26'\n          cache: false\n\n      - name: Install vexflow\n        run: go install github.com/carabiner-dev/vexflow@latest\n\n      - name: Run vexflow update\n        env:\n          GITHUB_TOKEN: ${{ secrets.VEXFLOW_TOKEN }}\n        run: |\n          vexflow update \\\n            --repo sherine-k/gophers-api \\\n            --branch main \\\n            --triage-repo sherine-k/.vexflow\n```\n\n**Key points:**\n- No actions/checkout is needed -- vexflow clones the target repo itself.\n- Since no recent release binaries were available, the workflow compiles vexflow from source with go install.\n- The `VEXFLOW_TOKEN` is used here as the GITHUB_TOKEN to give the workflow access to scan the code, to update GitHub issues and generate VEX attestations.\n\n## Step 4: First scan -- issues created\nThe [first workflow run](https://github.com/sherine-k/gophers-api/actions/runs/30887582253/job/91922877505) scanned the main branch with OSV Scanner. Vexflow found multiple vulnerabilities in the Go dependencies and automatically opened a triage issue for each one in [sherine-k/.vexflow/issues](https://github.com/sherine-k/.vexflow/issues).\nEach issue is titled `: VEX Exploitability Triage` and contains:\n- A summary table with the vulnerability ID, repository, branch, and affected component (purl)\n- Instructions and examples for all available slash commands\n- Hidden machine-readable data used by vexflow to track the triage state\n\nAt the time of writing, 59 open triage issues were tracked.\n\n## Step 5: Assess a vulnerability with a slash command\n\nSince gophers-api is written in go, I used GoVulnCheck to quickly assess some of the vulnerabilities using:\n```bash\ngovulncheck -format openvex  ./...\n```\n\nFor one of the vulnerabilities detected, [CVE-2026-46600](https://github.com/sherine-k/.vexflow/issues/30), govulncheck identifies that the vulnerable code isn't reacheable from the executable path. \n\nTherefore, I commented on the issue with a slash command:\n`/not_affected:vulnerable_code_not_in_execute_path`\n\nThe vulnerable function is not used in the API server code path.\nThe text after the slash command becomes the VEX impact statement published in the attestation.\n\n## Step 5: Vexflow processes the assessment\nOn the next workflow run (https://github.com/sherine-k/gophers-api/actions/runs/30887582253/job/91927094887), vexflow:\n1. Read the slash command on issue [#30](https://github.com/sherine-k/.vexflow/issues/30)\n2. Verified that `sherine-k` is listed in the `OWNERS` file\n3. Generated an OpenVEX document with status `not_affected` and justification `vulnerable_code_not_in_execute_path`\n4. Signed it with Sigstore and published it as a [GitHub attestation](https://github.com/sherine-k/.vexflow/attestations/38737637)\n5. Posted a confirmation comment on the issue\n6. Closed the issue\nThe attestation subject is git+https://github.com/sherine-k/gophers-api@main, and it can be verified with:\n```bash\ngh attestation verify \\\n  --owner sherine-k \\\n  --predicate-type \"https://openvex.dev/ns\" \\\n  \n```", "creation_timestamp": "2026-08-04T08:52:34.743674Z"}]}