Machine Identity Security Vulnerability in Identrail for AWS and Kubernetes
CVE-2026-59185

8.5HIGH

Key Information:

Vendor

Identrail

Status
Identrail
Vendor
CVE Published:
28 October 2026

What is CVE-2026-59185?

Identrail, a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes, contains an authorization bypass vulnerability that allows an authenticated user to access private repositories of other organizations. This occurs due to improper validation of installation_id in a critical API endpoint, where the system fails to ensure that the installation ID belongs to the user's workspace. This vulnerability also affects a secondary connection path, which shares similar issues. The flaw has been addressed in version 1.0.2.

Affected Version(s)

identrail < 1.0.2

References

https://github.com/identrail/identrail/security/advisorie...
x_refsource_CONFIRM
https://github.com/identrail/identrail/commit/835e4051750...
x_refsource_MISC
https://github.com/identrail/identrail/releases/tag/v1.0.2
x_refsource_MISC

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.