identrail: Cross-tenant GitHub installation binding without ownership verification

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete endpoint in internal/api/router.go accepts installation_id from the request body or X-GitHub-Installation-ID header without verifying the installation belongs to the caller's workspace. CompleteGitHubConnection in internal/api/github_connect.go rigorously binds state to the caller's tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller's connection. ListInstallationRepositories in internal/connectors/github/repositories.go invokes token creation through internal/connectors/github/app.go and POST /app/installations/{installationId}/access_tokens, using the application's JWT. An authenticated tenant who starts a legitimate connection can supply another customer's non-secret installation ID to read the victim organization's private repository inventory, content, and metadata or drive posture scans, provided identrail's GitHub App is installed there. The default-off V2 CompleteGitHubConnector path shares the installation-ownership gap and additionally matches pending state without rechecking caller scope. This issue is fixed in version 1.0.2.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ntrail/security/advisories/GHSA-cp3j-m783-3ph5 Diğer
• github.com/…ommit/835e40517509d6ef5405c27fbf14f579bedff0e7 Diğer
• github.com/identrail/identrail/releases/tag/v1.0.2 Diğer

Kayıt geçmişi

1. 28 Eki 2026 16:15Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-50541Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
• 7,1 CVE-2026-52729Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion
• 7,1 CVE-2026-59164NORA missing cross-user token-management authorization
• 7,5 CVE-2026-116393WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
• 6,5 CVE-2026-116404WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability
• 5,4 CVE-2026-116855WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability