CLEANSTART-2026-XF15574 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...

Security vulnerability affects the octo-sts package. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, helm-exporter, gpu-operator, crossplane-provider-aws-batch, trivy-k8s-wrapper-fips, cluster-proportional-autoscaler-fips, terraform-provider-azurerm-fips, crossplane-provider-azure-storagecache, fairwinds-gemini, mongodb-kubernetes-operator-fips,...

GO-2025-3779 vulnerabilities

Vulnerabilities for packages: octo-sts...

GO-2025-3779 vulnerabilities

Vulnerabilities for packages: octo-sts...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: tigera-operator, kubernetes-event-exporter, cloudnative-pg, govulncheck, kubeflow-katib, pulumi-kubernetes-operator, crossplane-provider-aws-cloudfront, octo-sts, grafana-alloy, cloud-provider-aws, skopeo, rancher-webhook, kubernetes-csi-livenessprobe, kuma,...

GHSA-W8RR-5GCM-PP58 vulnerabilities

Vulnerabilities for packages: grafana-alloy, fleet-server, jaeger-fips, terraform, kiali-fips, opa-fips-envoy, beats, knative-operator-fips, caddy, headlamp-fips, knative-net-istio-fips, harbor-registry, k6-operator-fips, gitlab-kas, docker, authentik-fips, grafana-image-renderer, gitaly-fips,...

CVE-2026-39882 vulnerabilities

Vulnerabilities for packages: grafana-alloy, fleet-server, jaeger-fips, terraform, kiali-fips, opa-fips-envoy, beats, knative-operator-fips, caddy, headlamp-fips, knative-net-istio-fips, harbor-registry, k6-operator-fips, gitlab-kas, docker, authentik-fips, grafana-image-renderer, gitaly-fips,...

SUSE CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

GO-2025-3779 Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens in github.com/octo-sts/app...

GHSA-H3QP-HWVR-9XCQ vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477 vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477 vulnerabilities

Vulnerabilities for packages: octo-sts...

GHSA-H3QP-HWVR-9XCQ vulnerabilities

Vulnerabilities for packages: octo-sts...

CVE-2025-52477

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

GHSA-H3QP-HWVR-9XCQ Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

Summary Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Please upgrade to v0.5.3 to resolve this issue. Th...

Octo STS Unauthenticated SSRF by abusing fields in OpenID Connect tokens

Summary Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Please upgrade to v0.5.3 to resolve this issue. Th...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

CVE-2025-52477: Server-Side Request Forgery (SSRF)

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...