13 matches found
CVE-2026-59185
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
CVE-2026-59185 identrail: Cross-tenant GitHub installation binding without ownership verification
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
CVE-2026-59185 identrail: Cross-tenant GitHub installation binding without ownership verification
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
EUVD-2026-112081
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
CVE-2026-59185
The identrail machine identity security platform is vulnerable to a cross-tenant Insecure Direct Object Reference (IDOR) before version 1.0.2 . The POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete endpoint (handled in internal/api/router.go) fails to verify that a pr...
CVE-2026-59185 identrail: Cross-tenant GitHub installation binding without ownership verification
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
CVE-2026-59185
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on "POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete" endpoint in "internal/api/router.go" accepts "installationid" from the request body or...
CVE-2026-59185: identrail: identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
identrail authorization issue vulnerability
Versions prior to identrail 1.0.2 contain an authorization issue vulnerability. This vulnerability arises because the endpoint handling GitHub connections fails to verify whether the installationid belongs to the caller’s workspace. As a result, authenticated tenants may be able to read the priva...
SUSE CVE-2026-59185
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspaceid/projects/:projectid/github/connect/complete endpoint in internal/api/router.go accepts installationid from the request body or...
GO-2026-6448 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail
Identrail Cross-tenant IDOR: Client-supplied GitHub App installationid is bound to the caller's workspace without ownership verification in github.com/identrail/identrail...
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installati...
GHSA-CP3J-M783-3PH5 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installati...