https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 20:12:37 +0000 https://db.gcve.eu/vuln/cve-2026-59185 <p><strong>Affected:</strong> identrail</p> <p>identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller&#39;s workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller&#39;s tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller&#39;s connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application&#39;s JWT. An authenticated tenant who starts a legitimate connection can supply another customer&#39;s non-secret installation ID to read the victim organization&#39;s private repository inventory, content, and metadata or drive posture scans, provided identrail&#39;s GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2.</p> <p><strong>Affected:</strong> identrail</p> <p>identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller&#39;s workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller&#39;s tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller&#39;s connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application&#39;s JWT. An authenticated tenant who starts a legitimate connection can supply another customer&#39;s non-secret installation ID to read the victim organization&#39;s private repository inventory, content, and metadata or drive posture scans, provided identrail&#39;s GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2.</p> https://db.gcve.eu/vuln/cve-2026-59185