Reaching an Internal OpenAI Repository Through an HEIF RCE and Overprivileged SSO Token Chain

What it is

A researcher-demonstrated vulnerability chain (Hacktron AI, published 2026-09-13) that reached an internal OpenAI GitHub repository starting from a public Discourse forum. The entry point is CVE-2026-32882 (GHSA-vhm9-85gw-x335), a heap overflow in libheif 1.19.7 reachable through Discourse's image-processing path. The Discourse advisory rated it CVSS 8.8, low privileges required. OpenAI paid a $6,500 bounty; the full chain was built in under 72 hours.

How it works

The four-stage chain crosses two trust boundaries — from anonymous upload to RCE, and from a forum session to internal dev assets:

flowchart TD
    A[Attacker uploads crafted HEIF] --> B[FastImage can't handle HEIF]
    B --> C[ImageMagick routes to libheif 1.19.7]
    C --> D[Heap overflow -> RCE in image container]
    D --> E[Steal over-privileged OpenAI SSO token]
    E -.crosses boundary.-> F[Access employee ChatGPT/Codex account]
    F -.crosses boundary.-> G[Codex GitHub connection -> internal repo]
    G --> H[Create README pull request]

The pivot turns on two things being present in the forum environment: an OpenAI SSO token scoped broadly enough to hit the ChatGPT/Codex API, and a Codex account with GitHub connected. RCE gets the token; the token gets the account; the account's connector gets the repo.

Preconditions / Affected

• Discourse running vulnerable libheif 1.19.7 in a HEIF/HEIC-capable image pipeline.
• The service uses OpenAI SSO and its token carries excessive ChatGPT/Codex API scope.
• The target account has external connectors (GitHub) attached to Codex.

What to do

• Rebuild the Discourse Docker image with patched libheif; sandbox image processing.
• Scope SSO tokens to the minimum per use case; revoke existing tokens and sessions (OpenAI did both).
• Re-authenticate connection destinations and inventory over-broad SSO scopes and high-privilege connectors.

Detection / hunting:

• EDR: ImageMagick crashes, libheif exceptions, abnormal memory access, child shells inside the image-processing container.
• Identity: ChatGPT/Codex API access using a forum-scoped token; session reuse.
• SaaS: Codex operation history, GitHub metadata reads and PR creation.
• The chain is only trackable if identifiers span SSO issuance → API usage → connector operations; without that correlation it cannot be reconstructed.

Caveats

The demonstration was intentionally limited: only repository metadata, commits, and a README pull request. OpenAI confirmed Slack messages were not accessed. Exploit development for the ASLR-enabled target used Claude Opus 4.8 and Opus 5 but required expert guidance — not fully autonomous. Unknowns remain: the exact token scopes, whether anyone besides the researchers exploited it, and which other libheif-using services are similarly exposed.