Vendor
Octo STS versions prior to 0.11.2 contain an information disclosure vulnerability where sensitive trust policy details, including internal cloud account identifiers and repository references, are exposed via Exchange error messages to unauthorized OIDC token holders.