Cpe:2.3:a:octo-Sts:octo_sts:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aocto-stsocto_sts/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 04:05:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOcto STS: Trust policy information disclosure (CVE-2026-105770)https://feed.craftedsignal.io/briefs/2026-11-octo-sts-disclosure/Tue, 03 Nov 2026 04:05:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-octo-sts-disclosure/Octo STS versions prior to 0.11.2 contain an information disclosure vulnerability where sensitive trust policy details, including internal cloud account identifiers and repository references, are exposed via Exchange error messages to unauthorized OIDC token holders.Octo STS versions before 0.11.2 are susceptible to an information disclosure flaw (CVE-2026-105770). The application inappropriately includes sensitive trust policy configuration fields - such as issuer, subject, audience patterns, and claim patterns - within 'PermissionDenied' error messages returned by the Exchange service. An unauthorized user possessing any validly signed OIDC token, including GitHub Actions tokens from attacker-controlled repositories, can trigger these errors to reveal internal security configurations, potentially including references to private repositories, branch names, environment settings, or cloud account identifiers. The vulnerability does not allow for token minting or security policy bypass.

Impact

Successful exploitation allows an attacker to enumerate internal security architecture, mapping internal repositories, cloud accounts, and environment naming conventions. This information can be utilized for reconnaissance in further attacks against the organization's infrastructure.

Recommendation

  • Upgrade Octo STS to version 0.11.2 or later immediately to address the error handling flaw.
  • Review internal trust policy configurations for any sensitive secrets or overly descriptive naming conventions that might have been disclosed if this vulnerability was exploited prior to patching.
]]>mediumadvisory