Live › vulnerability › CVE-2026-59185
Go to dashboardidentrail's GitHub connect endpoint accepts any GitHub App installation ID without checking it belongs to the caller's workspace. An authenticated tenant can supply another customer's installation ID to read that organization's private repository inventory and content, provided identrail's GitHub App is installed there.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Teams running identrail in a multi-tenant setup where several workspaces or customers share one instance and the identrail GitHub App is installed in their GitHub organizations. Any authenticated tenant who can start a GitHub connection can reach another tenant's installation. Single-tenant deployments with no untrusted users are less exposed.
No product ranges from the sources yet.
1.0.2 are affected.POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete in internal/api/router.go of your deployment.CompleteGitHubConnector path is enabled.1.0.2.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete endpoint in internal/api/router.go accepts installation_id from the request body or X-GitHub-Installation-ID header without verifying the installation belongs to the caller's workspace. CompleteGitHubConnection in internal/api/github_connect.go rigorously binds state to the caller's tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller's connection. ListInstallationRepositories in internal/connectors/github/repositories.go invokes token creation through internal/connectors/github/app.go and POST /app/installations/{installationId}/access_tokens, using the application's JWT. An authenticated tenant who starts a legitimate connection can supply another customer's non-secret installation ID to read the victim organization's private repository inventory, content, and metadata or drive posture scans, provided identrail's GitHub App is installed there. The default-off V2 CompleteGitHubConnector path shares the installation-ownership gap and additionally matches pending state without rechecking caller scope. This issue is fixed in version 1.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-59185")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.