Tag
GitHub Actions GITHUB_TOKEN Disclosure via Composer Validation Failure
2 rules 1 TTPComposer leaks GitHub OAuth tokens in GitHub Actions logs if they do not match the expected format due to a validation regex, leading to potential unauthorized access.
Portainer JWT Leak via URL Query Parameter
2 rules 1 TTPPortainer's authentication middleware accepts JWT bearer tokens passed as the `?token=<JWT>` URL query parameter on any authenticated API endpoint, leading to JWT leakage to logs and referrers, where a leaked token grants the full privileges of the user it was issued to, until the token expires.
Vault Token Leak via Authorization Header Forwarding
2 rules 1 TTP 1 CVEVault instances configured to pass through the 'Authorization' header may forward Vault tokens to auth plugin backends when the header is used for authentication, potentially leading to token compromise; this vulnerability is tracked as CVE-2026-4525 and patched in versions 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
Kyverno Service Account Token Leak via API Call
2 rules 1 TTP 5 IOCsKyverno's apiCall serviceCall helper implicitly injects the Kyverno controller service account token into requests when policies lack an explicit Authorization header, allowing exfiltration to attacker-controlled endpoints and unauthorized actions.