CVE-2026-105165

Received Received - Intake

Incorrect Permission Assignment in devopspolis secrets-replicator

Publication date: 2026-10-04

Last updated on: 2026-10-04

Assigner: VulDB

Description

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-04

Last Modified

2026-10-04

Generated

2026-10-05

AI Q&A

2026-10-05

EPSS Evaluated

N/A

NVD

CVE-2026-105165

EUVD

EUVD-2026-92131

Affected Vendors & Products

Vendor	Product	Version / Range
devopspolis	secrets-replicator	to 0.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-275	Permission Issues
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the devopspolis secrets-replicator tool up to version 0.4.0. It involves the AssumeRole Handler component in the file src/handler.py. Manipulating the external_id argument leads to incorrect permission assignments, potentially allowing unauthorized access or actions.

Detection Guidance

Detection requires checking the version of devopspolis secrets-replicator installed. Use commands like 'pip show secrets-replicator' or 'dpkg -l | grep secrets-replicator' to verify if the version is below 0.5.0.

Impact Analysis

An attacker could remotely exploit this flaw to gain elevated permissions or access sensitive data by manipulating the external_id parameter. This may result in unauthorized actions, data breaches, or system compromise depending on the affected environment.

Compliance Impact

This vulnerability could lead to unauthorized access or data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations using the affected software may face compliance violations, potential fines, and reputational damage.

Mitigation Strategies

Upgrade devopspolis secrets-replicator to version 0.5.0 or later immediately. Use the patch 'b42239405fbf4fae3c3f0048fc0b4225112edceb' if manual installation is required.

Hi! I’m here to help you understand CVE-2026-105165. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70