Vulnerability in Octo STS Affects Token Management in Security Policies

CVE-2026-105770

What is CVE-2026-105770?

The Octo STS product prior to version 0.11.2 contains a vulnerability that allows attackers holding a valid OIDC token to retrieve sensitive trust policy configurations. This occurs because the system returns trust policy details, including issuer, subject, and audience values in error messages, even for tokens that do not satisfy the policy. An attacker can exploit this by using a GitHub Actions token from a repository they control, allowing them to disclose private policy rules that may reference internal repositories or cloud account identifiers. This vulnerability has been addressed in the 0.11.2 patch.

References