Vulnerability-Lookup

CVE-2026-59185 (GCVE-0-2026-59185)

Vulnerability from cvelistv5 – Published: 2026-10-28 13:15 – Updated: 2026-10-28 16:07

Title

identrail: Cross-tenant GitHub installation binding without ownership verification

Summary

identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller's workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller's tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller's connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application's JWT. An authenticated tenant who starts a legitimate connection can supply another customer's non-secret installation ID to read the victim organization's private repository inventory, content, and metadata or drive posture scans, provided identrail's GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2.

Severity

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-28 14:37 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key
CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7836 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/identrail/identrail/security/a…	x_refsource_CONFIRM
https://github.com/identrail/identrail/commit/835…	x_refsource_MISC
https://github.com/identrail/identrail/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
identrail	identrail	Affected: < 1.0.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59185",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T14:37:16.463171Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T16:07:10.634Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "identrail",
          "vendor": "identrail",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller\u0027s workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller\u0027s tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller\u0027s connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application\u0027s JWT. An authenticated tenant who starts a legitimate connection can supply another customer\u0027s non-secret installation ID to read the victim organization\u0027s private repository inventory, content, and metadata or drive posture scans, provided identrail\u0027s GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T13:15:53.456Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5"
        },
        {
          "name": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7"
        },
        {
          "name": "https://github.com/identrail/identrail/releases/tag/v1.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/identrail/identrail/releases/tag/v1.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-cp3j-m783-3ph5",
        "discovery": "UNKNOWN"
      },
      "title": "identrail: Cross-tenant GitHub installation binding without ownership verification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59185",
    "datePublished": "2026-10-28T13:15:53.456Z",
    "dateReserved": "2026-07-02T19:53:48.830Z",
    "dateUpdated": "2026-10-28T16:07:10.634Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59185",
      "date": "2026-11-09",
      "epss": "0.0032",
      "percentile": "0.25149"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "identrail",
                "vendor": "identrail",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.0.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller\u0027s workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller\u0027s tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller\u0027s connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application\u0027s JWT. An authenticated tenant who starts a legitimate connection can supply another customer\u0027s non-secret installation ID to read the victim organization\u0027s private repository inventory, content, and metadata or drive posture scans, provided identrail\u0027s GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2."
          }
        ],
        "id": "CVE-2026-59185",
        "lastModified": "2026-10-28T16:17:08.510",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.7,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59185",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T14:37:16.463171Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-28T14:17:05.070",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/identrail/identrail/releases/tag/v1.0.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              },
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-21T16:50:42Z",
      "cve": "CVE-2026-59185",
      "id": "CVE-2026-59185",
      "initial_release_date": "2026-09-21T16:50:42Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-59185",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-59185.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59185",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-28T14:37:16.463171Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-28T14:37:21.536Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "identrail",
              "vendor": "identrail",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.0.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller\u0027s workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller\u0027s tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller\u0027s connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application\u0027s JWT. An authenticated tenant who starts a legitimate connection can supply another customer\u0027s non-secret installation ID to read the victim organization\u0027s private repository inventory, content, and metadata or drive posture scans, provided identrail\u0027s GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862: Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-28T13:15:53.456Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5"
            },
            {
              "name": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7"
            },
            {
              "name": "https://github.com/identrail/identrail/releases/tag/v1.0.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/identrail/identrail/releases/tag/v1.0.2"
            }
          ],
          "source": {
            "advisory": "GHSA-cp3j-m783-3ph5",
            "discovery": "UNKNOWN"
          },
          "title": "identrail: Cross-tenant GitHub installation binding without ownership verification"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-59185",
        "datePublished": "2026-10-28T13:15:53.456Z",
        "dateReserved": "2026-07-02T19:53:48.830Z",
        "dateUpdated": "2026-10-28T16:07:10.634Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-59185

Vulnerability from fkie_nvd - Published: 2026-10-28 14:17 - Updated: 2026-10-28 16:17

Severity

8.5 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7
	security-advisories@github.com	https://github.com/identrail/identrail/releases/tag/v1.0.2
	security-advisories@github.com	https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "identrail",
          "vendor": "identrail",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller\u0027s workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller\u0027s tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller\u0027s connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application\u0027s JWT. An authenticated tenant who starts a legitimate connection can supply another customer\u0027s non-secret installation ID to read the victim organization\u0027s private repository inventory, content, and metadata or drive posture scans, provided identrail\u0027s GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2."
    }
  ],
  "id": "CVE-2026-59185",
  "lastModified": "2026-10-28T16:17:08.510",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59185",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-28T14:37:16.463171Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-28T14:17:05.070",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/identrail/identrail/releases/tag/v1.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CP3J-M783-3PH5

Vulnerability from github – Published: 2026-09-09 23:52 – Updated: 2026-09-09 23:52

Summary

Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Details

Summary

identrail's GitHub App connection-completion endpoint binds a fully client-supplied installation_id to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied installation_id using the app's own JWT, so an authenticated tenant can link any other identrail customer's GitHub App installation into their own workspace and read that victim organization's private repositories.

Affected code (default-on path, no feature flag)

Route: internal/api/router.go:3590 — POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete. installation_id is read from the JSON body or the attacker-controlled X-GitHub-Installation-ID header (router.go:3582-3588).
Service: internal/api/github_connect.go:781 CompleteGitHubConnection. The state token IS rigorously bound to the caller's scope (github_connect.go:818: if stateRecord.TenantID != scope.TenantID || stateRecord.WorkspaceID != project.WorkspaceID || stateRecord.ProjectID != project.ProjectID { ... }), but the only check on installation_id is request.InstallationID <= 0 (:794). The raw client value is persisted as the workspace's connection (:840).
Cross-tenant read primitive: internal/connectors/github/repositories.go:39 ListInstallationRepositories → internal/connectors/github/app.go:170 mints a token via POST /app/installations/{installationId}/access_tokens signed with the App JWT, succeeding for any installation where identrail's app is installed.

The feature-flagged V2 path CompleteGitHubConnector (github_connect.go:447, default off) shares the gap and is additionally weaker (matches pending connector by state value alone with no caller-scope re-check); a single fix should cover both.

Intent proof

The code binds state to {TenantID, WorkspaceID, ProjectID} and re-verifies it at completion (:818), demonstrating it understands binding is required. The asymmetry — state bound, installation_id unbound — is the missed check.

Exploitation

Attacker is any authenticated identrail tenant; they call StartGitHubConnection for their own workspace and receive a state.
Attacker calls the completion route with {state: <their state>, installation_id: V} where V is a victim org's identrail GitHub App installation id (installation ids are not secret — they appear in post-install redirect URLs, webhook payloads, the org's GitHub App settings, and are enumerable integers).
CompleteGitHubConnection accepts (state matches attacker scope), ListInstallationRepositories(V) mints a token for V and lists the victim org's private repos, and the connection is persisted under the attacker's workspace.
Attacker now reads the victim org's private repository inventory and can drive posture scans/repo reads via their own workspace.

Impact: cross-tenant disclosure of another customer organization's private GitHub repositories and metadata.

Remediation

Bind installation_id with the same rigor as state: capture it from GitHub's signed post-install redirect (setup_url/callback_url) and pin it to the pending state at start time, and/or after minting verify the installation's account matches the org the initiating workspace is authorized for.

Severity

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/identrail/identrail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59185"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-09T23:52:14Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nidentrail\u0027s GitHub App connection-completion endpoint binds a fully client-supplied `installation_id` to the caller\u0027s workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied `installation_id` using the app\u0027s own JWT, so an authenticated tenant can link any other identrail customer\u0027s GitHub App installation into their own workspace and read that victim organization\u0027s private repositories.\n\n## Affected code (default-on path, no feature flag)\n\n- Route: `internal/api/router.go:3590` \u2014 `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete`. `installation_id` is read from the JSON body or the attacker-controlled `X-GitHub-Installation-ID` header (`router.go:3582-3588`).\n- Service: `internal/api/github_connect.go:781` `CompleteGitHubConnection`. The `state` token IS rigorously bound to the caller\u0027s scope (`github_connect.go:818`: `if stateRecord.TenantID != scope.TenantID || stateRecord.WorkspaceID != project.WorkspaceID || stateRecord.ProjectID != project.ProjectID { ... }`), but the only check on `installation_id` is `request.InstallationID \u003c= 0` (`:794`). The raw client value is persisted as the workspace\u0027s connection (`:840`).\n- Cross-tenant read primitive: `internal/connectors/github/repositories.go:39` `ListInstallationRepositories` \u2192 `internal/connectors/github/app.go:170` mints a token via `POST /app/installations/{installationId}/access_tokens` signed with the App JWT, succeeding for any installation where identrail\u0027s app is installed.\n\nThe feature-flagged V2 path `CompleteGitHubConnector` (`github_connect.go:447`, default off) shares the gap and is additionally weaker (matches pending connector by `state` value alone with no caller-scope re-check); a single fix should cover both.\n\n## Intent proof\n\nThe code binds `state` to `{TenantID, WorkspaceID, ProjectID}` and re-verifies it at completion (`:818`), demonstrating it understands binding is required. The asymmetry \u2014 `state` bound, `installation_id` unbound \u2014 is the missed check.\n\n## Exploitation\n\n1. Attacker is any authenticated identrail tenant; they call `StartGitHubConnection` for their own workspace and receive a `state`.\n2. Attacker calls the completion route with `{state: \u003ctheir state\u003e, installation_id: V}` where V is a victim org\u0027s identrail GitHub App installation id (installation ids are not secret \u2014 they appear in post-install redirect URLs, webhook payloads, the org\u0027s GitHub App settings, and are enumerable integers).\n3. `CompleteGitHubConnection` accepts (state matches attacker scope), `ListInstallationRepositories(V)` mints a token for V and lists the victim org\u0027s private repos, and the connection is persisted under the attacker\u0027s workspace.\n4. Attacker now reads the victim org\u0027s private repository inventory and can drive posture scans/repo reads via their own workspace.\n\nImpact: cross-tenant disclosure of another customer organization\u0027s private GitHub repositories and metadata.\n\n## Remediation\n\nBind `installation_id` with the same rigor as `state`: capture it from GitHub\u0027s signed post-install redirect (`setup_url`/`callback_url`) and pin it to the pending state at start time, and/or after minting verify the installation\u0027s `account` matches the org the initiating workspace is authorized for.",
  "id": "GHSA-cp3j-m783-3ph5",
  "modified": "2026-09-09T23:52:14Z",
  "published": "2026-09-09T23:52:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/identrail/identrail/security/advisories/GHSA-cp3j-m783-3ph5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/identrail/identrail/commit/835e40517509d6ef5405c27fbf14f579bedff0e7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/identrail/identrail"
    },
    {
      "type": "WEB",
      "url": "https://github.com/identrail/identrail/releases/tag/v1.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller\u0027s workspace without ownership verification"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59185 (GCVE-0-2026-59185)

FKIE_CVE-2026-59185

GHSA-CP3J-M783-3PH5

Summary

Affected code (default-on path, no feature flag)

Intent proof

Exploitation

Remediation

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour