octo-sts

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

octo-sts records in CISA KEV

No octo-sts vulnerabilities are listed in CISA KEV.

3 records

TI-2025-32604 CVE-2025-52477 · GHSA-h3qp-hwvr-9xcq

MEDIUM 44

Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00486 Published 2025-06-26 Fixed in 0.5.3 CWE-918

TI-2026-84130 CVE-2026-105770

LOW 30

Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00256 Published 2026-11-03 Fixed in 0.11.2 CWE-209

TI-2024-22536 CVE-2024-34079 · GHSA-75r6-6jg8-pfcq

LOW 18

octo-sts is a GitHub App that acts like a Security Token Service (STS) for the Github API.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00581 Published 2024-05-10 Fixed in 0.1.0 CWE-400