CVE-2026-105770 Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

CVE-2026-105770

Octo STS (github.com/octo-sts/app ) versions prior to 0.11.2 are vulnerable to a sensitive information disclosure vulnerability. The TrustPolicy.CheckToken function includes internal policy details—such as issuer, subject, audience values, patterns, and regular expressions—within PermissionDenied...