CVE-2026-105770

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

CVE-2026-105770 Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

EUVD-2026-115653

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

CVE-2026-105770

Octo STS (github.com/octo-sts/app ) versions prior to 0.11.2 are vulnerable to a sensitive information disclosure vulnerability. The TrustPolicy.CheckToken function includes internal policy details—such as issuer, subject, audience values, patterns, and regular expressions—within PermissionDenied...

CVE-2026-105770: octo-sts app: Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does…

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

PT-2026-135833

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim pattern names and regular expressions in its...

CLEANSTART-2026-XF15574 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the octo-sts package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-redshift-fips, flux-image-automation-controller-fips, scuttle, sftpgo-plugin-pubsub, nrdot-collector-fips, crossplane-provider-aws-eks-fips, buildkite-agent, azurefile-csi, aws-otel-collector, kubernetes-dashboard-fips,...

GO-2025-3779 vulnerabilities

Vulnerabilities for packages: octo-sts...

GO-2025-3779 vulnerabilities

Vulnerabilities for packages: octo-sts...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: vault-k8s, newrelic-infra-operator, fuse-overlayfs-snapshotter, sftpgo-plugin-pubsub, trufflehog, polaris, cloudnative-pg, net-kourier, authservice, docker-machine-driver-harvester, apache-exporter, harbor-scanner-trivy, crossplane-provider-aws-rds,...

GHSA-W8RR-5GCM-PP58 vulnerabilities

Vulnerabilities for packages: spicedb-fips, knative-net-istio-fips, kubescape-server-fips, gotenberg, external-secrets-operator-fips, authentik, net-kourier, grafana-image-renderer, amazon-cloudwatch-agent-fips, grafana-fips, aws-otel-collector, prometheus-fips, keda-fips, traefik, kubo-fips,...

CVE-2026-39882 vulnerabilities

Vulnerabilities for packages: spicedb-fips, knative-net-istio-fips, kubescape-server-fips, gotenberg, external-secrets-operator-fips, authentik, net-kourier, grafana-image-renderer, amazon-cloudwatch-agent-fips, grafana-fips, aws-otel-collector, prometheus-fips, keda-fips, traefik, kubo-fips,...

SUSE CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

GO-2025-3779 Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app...

GHSA-H3QP-HWVR-9XCQ vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477 vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477 vulnerabilities

Vulnerabilities for packages: octo-sts...

GHSA-H3QP-HWVR-9XCQ vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...