Octo STS: Trust policy information disclosure (CVE-2026-105770)

Octo STS versions before 0.11.2 are susceptible to an information disclosure flaw (CVE-2026-105770). The application inappropriately includes sensitive trust policy configuration fields - such as issuer, subject, audience patterns, and claim patterns - within 'PermissionDenied' error messages returned by the Exchange service. An unauthorized user possessing any validly signed OIDC token, including GitHub Actions tokens from attacker-controlled repositories, can trigger these errors to reveal internal security configurations, potentially including references to private repositories, branch names, environment settings, or cloud account identifiers. The vulnerability does not allow for token minting or security policy bypass.

Impact

Successful exploitation allows an attacker to enumerate internal security architecture, mapping internal repositories, cloud accounts, and environment naming conventions. This information can be utilized for reconnaissance in further attacks against the organization's infrastructure.

Recommendation

• Upgrade Octo STS to version 0.11.2 or later immediately to address the error handling flaw.
• Review internal trust policy configurations for any sensitive secrets or overly descriptive naming conventions that might have been disclosed if this vulnerability was exploited prior to patching.