layne

Layne Layne es una GitHub App autoalojada que centraliza el escaneo de seguridad en todos nuestros repositorios. Como no utilizamos herramientas comerciales de escaneo SAST/de secretos, ni tenemos acceso a GitHub Enterprise, puede resultar difícil mantener distintos archivos de workflow de GitHub...

CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installati...

GHSA-CP3J-M783-3PH5 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installati...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86492

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

CVE-2026-86492

JetBrains YouTrack versions before 2026.2.18634 are affected by a vulnerability in a shared token cache that permits cross-tenant theft of GitHub App installation tokens . An attacker with low privileges over the network (no user interaction required) can steal tokens belonging to other tenants, ...

EUVD-2026-72508

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens...

allstar v4.6

Allstar !IMPORTANT The OpenSSF-hosted Allstar GitHub App has been retired. Allstar, the OpenSSF Scorecard subproject, itself continues to be maintained — you must now run it yourself, either as a GitHub Action or as a service daemon. See ossf/allstar881 for more details. If your organization was...

CVE-2026-82282

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282

Atlantis (through version 0.47.1 ) contains an authentication bypass in the /github-app/setup endpoint. The endpoint fails to require authentication, allowing unauthenticated callers to observe or intercept the GitHub redirect during app setup and extract the RSA private key and webhook secret . ...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

EUVD-2026-67813

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

GO-2026-6266 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header in github.com/openshift-pipelines/pipelines-as-code...

GO-2026-6263 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution in github.com/openshift-pipelines/pipelines-as-code...

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

GHSA-6F2P-296R-CC28 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

GHSA-F5F4-3HH4-F54M Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...