Read the docs
TI-2026-67671 Aliases CVE-2026-105165GHSA-88p5-cp9r-57qh

Incorrect permissions in secrets-replicator AssumeRole handler

Priority LOW 23CWE-275Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

devopspolis secrets-replicator versions from 0.1 before 0.5.0 are affected. The process_single_secret function in the AssumeRole handler mishandles the external_id argument, which leads to incorrect permission assignment (CWE-732). A remote attacker with low privileges can affect confidentiality, integrity and availability, with limited impact and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb. It is suggested to upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00209 11th percentileScored 2026-11-07
Fix Fixed secrets-replicator (devopspolis): 0.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
devopspolissecrets-replicator0.1; 0.2; 0.3; 0.4.00.5.0Patch availableCNA
  • secrets-replicator Vendordevopspolis Affected 0.1; 0.2; 0.3; 0.4.0 Fixed in 0.5.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:devopspolis:secrets-replicator:*:*:*:*:*:*:*:*——devopspolis
  • cpe:2.3:a:devopspolis:secrets-replicator:*:*:*:*:*:*:*:* Versions — — ·devopspolis

Remediation

Upgrade devopspolis secrets-replicator to version 0.5.0, which fixes the flaw. The patch is commit b42239405fbf4fae3c3f0048fc0b4225112edceb.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA secrets-replicator (devopspolis) Fixed in 0.5.0

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-105165
  2. 2026-10-05 Alias added: GHSA-88p5-cp9r-57qh

References

Patch 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences