CVE-2026-105770
Received Received - Intake

Octo STS Trust Policy Information Disclosure

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: chainguard

Description
Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names and regular expressions in its PermissionDenied errors, which Exchange returned verbatim. Exchange also selected the GitHub App installation before checking the token, so errors from resolving the policy's app or app_pattern pin were returned to callers the policy does not trust. An attacker who holds any validly signed OIDC token, such as a GitHub Actions token from a repository they own, and who knows or guesses a target owner/repo and identity name can read that policy's matching rules, even when the policy is stored in a private repository. These rules often name internal repositories, branches, environments or cloud account identifiers. The issue does not allow minting tokens or bypassing a trust policy. This issue is fixed in 0.11.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-105770

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
octo-sts app 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Octo STS before 0.11.2 involves improper handling of trust policy checks during OIDC token validation. When a caller's token failed to satisfy a policy, error messages exposed sensitive details like issuer, subject, audience, claim patterns, and app pin resolution errors. Attackers with a valid OIDC token could infer internal policy configurations, such as repository names or cloud account identifiers, by guessing target details.

Detection Guidance

Check if your octo-sts app version is below 0.11.2 by running: git ls-remote --tags https://github.com/octo-sts/app | grep v0.11.2. If not present, the system is vulnerable. Review Exchange error logs for detailed policy mismatch messages before 0.11.2, which may indicate information leakage.

Impact Analysis

An attacker with a valid OIDC token, such as a GitHub Actions token from a repository they control, could learn sensitive details about private trust policies. This includes internal repository names, branches, environments, or cloud account identifiers. While the attacker cannot mint tokens or bypass policies, they gain reconnaissance about the target's infrastructure.

Mitigation Strategies

Upgrade octo-sts to version 0.11.2 or later immediately. Update dependencies via Dependabot if used. Review and restrict access to OIDC tokens and trust policies. Monitor logs for unauthorized access attempts or policy-related errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...