GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: vault-fips, crossplane-provider-aws-kinesis, kratos, terraform-provider-random-fips, kubernetes-csi-external-resizer-fips, go-fips-md5, crane-fips, spicedb-operator-fips, scuttle, gitlab-pages-fips, flux-fips, karpenter, buildkitd, crossplane-provider-aws-qldb-fips,...

GO-2025-3779 vulnerabilities

Vulnerabilities for packages: octo-sts...

GO-2025-3779 vulnerabilities

Vulnerabilities for packages: octo-sts...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: cortex, src-fingerprint, istio, sops, frp, sftpgo-plugin-auth, knative-serving, terraform-docs, slsa-verifier, govulncheck, kyverno, nova, kubernetes-csi-external-snapshotter, goreleaser, kubo, nri-haproxy, crossplane-provider-aws-cloudformation,...

GHSA-W8RR-5GCM-PP58 vulnerabilities

Vulnerabilities for packages: bento, knative-eventing-fips, vault-fips, prometheus-alertmanager-fips, cilium-fips, argo-workflows, frankenphp-8.3, envoy-gateway-fips, keda-fips, datadog-agent, harbor-fips, opentelemetry-collector-fips, external-dns, external-secrets-operator,...

CVE-2026-39882 vulnerabilities

Vulnerabilities for packages: bento, knative-eventing-fips, vault-fips, prometheus-alertmanager-fips, cilium-fips, argo-workflows, frankenphp-8.3, envoy-gateway-fips, keda-fips, datadog-agent, harbor-fips, opentelemetry-collector-fips, external-dns, external-secrets-operator,...

SUSE CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

GO-2025-3779 Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app...

GHSA-H3QP-HWVR-9XCQ vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477 vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477 vulnerabilities

Vulnerabilities for packages: octo-sts...

GHSA-H3QP-HWVR-9XCQ vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

GHSA-H3QP-HWVR-9XCQ Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

Summary Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Please upgrade to v0.5.3 to resolve this issue. Th...

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

Summary Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Please upgrade to v0.5.3 to resolve this issue. Th...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

octo-sts 代码问题漏洞

octo-sts is a Chainguard's GitHub security token service open-sourced by octo-sts. A code issue vulnerability exists in octo-sts versions prior to v0.5.3, which stems from an unauthenticated server-side request forgery vulnerability...

PT-2025-27002 · Github · Octo-Sts

Name of the Vulnerable Software and Affected Versions: Octo-STS versions prior to v0.5.3 Description: Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. The issue allows for unauthenticated Server-Side Request Forgery SSRF by abusing fields in OpenID Connect...