{"answers":{"affected":"3 open source packages ship an affected version, including github.com/identrail/identrail.","exploited":"There is no known exploitation of CVE-2026-59185 in the wild and no public exploit code.","fix":"Upgrade github.com/identrail/identrail to 1.0.2 or later.","what":"CVE-2026-59185 is a high-severity vulnerability in identrail, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-59185 and fix it if it is affected.\n\nWhat it is: CVE-2026-59185 is a high-severity vulnerability in identrail, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-59185 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/identrail/identrail (Go): affected all versions; fixed in 1.0.2\n- github.com/identrail/identrail (Go): affected all versions; fixed in 1.0.2\n- github.com/identrail/identrail (Go): affected all versions; fixed in 1.0.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-59185/ (Markdown: https://insights.sbomify.com/CVE-2026-59185/index.md)","id":"CVE-2026-59185","markdown":"https://insights.sbomify.com/CVE-2026-59185/index.md","name":"CVE-2026-59185","record":{"aliases":["GHSA-cp3j-m783-3ph5","GO-2026-6448"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":8.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"},{"id":"CWE-639","name":"Authorization Bypass Through User-Controlled Key"}],"description":"identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_id` from the request body or `X-GitHub-Installation-ID` header without verifying the installation belongs to the caller's workspace. `CompleteGitHubConnection` in `internal/api/github_connect.go` rigorously binds `state` to the caller's tenant, workspace, and project, but checks only that the installation ID is positive before persisting it as the caller's connection. `ListInstallationRepositories` in `internal/connectors/github/repositories.go` invokes token creation through `internal/connectors/github/app.go` and `POST /app/installations/{installationId}/access_tokens`, using the application's JWT. An authenticated tenant who starts a legitimate connection can supply another customer's non-secret installation ID to read the victim organization's private repository inventory, content, and metadata or drive posture scans, provided identrail's GitHub App is installed there. The default-off V2 `CompleteGitHubConnector` path shares the installation-ownership gap and additionally matches pending `state` without rechecking caller scope. This issue is fixed in version 1.0.2.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"identrail: Cross-tenant GitHub installation binding without ownership verification","id":"CVE-2026-59185","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":null,"year":"2026"},"n_packages":3,"n_references":3,"next":{"headline":"OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) builds","id":"CVE-2026-59186"},"packages":[{"ecosystem":"Go","fixed":["1.0.2"],"introduced":["0"],"last_affected":[],"package":"github.com/identrail/identrail","purl":null,"source":"GHSA-cp3j-m783-3ph5"},{"ecosystem":"Go","fixed":["1.0.2"],"introduced":["0"],"last_affected":[],"package":"github.com/identrail/identrail","purl":"pkg:golang/github.com/identrail/identrail","source":"GHSA-cp3j-m783-3ph5"},{"ecosystem":"Go","fixed":["1.0.2"],"introduced":["0"],"last_affected":[],"package":"github.com/identrail/identrail","purl":"pkg:golang/github.com/identrail/identrail","source":"GO-2026-6448"}],"prev":{"headline":"OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write","id":"CVE-2026-59184"},"products":["identrail"],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-28","vendors":["identrail"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-59185/"}