CVE-2026-59185

HIGHPre-NVD 8.58.5
EchelonGraph scoreLOW confidence

This high-severity CVE scores 8.5 under the CNA's CVSS (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). No GitHub Security Advisory CVSS is on record for this CVE.

Triggered by: Headline CVSS from the CNA's CVSS
Sources: the CNA's CVSS
8.5EG
EchelonGraph verdictPlan a fixRemediate within your standard update timelines (the SSVC decision on this page).
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: —CVSS: 8.5Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Summary

identrail's GitHub App connection-completion endpoint binds a fully client-supplied installation_id to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied installation_id using the app's own JWT, so an authenticated tenant can link any other identrail customer's GitHub App installation into their own workspace and read that victim organization's private repositories.

Affected code (default-on path, no feature flag)

  • Route: internal/api/router.go:3590 — POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete. installation_id is read from the JSON body or the attacker-controlled X-GitHub-Installation-ID header (router.go:3582-3588).
  • Service: internal/api/github_connect.go:781 CompleteGitHubConnection. The state token IS rigorously bound to the caller's scope (github_connect.go:818: if stateRecord.TenantID != scope.TenantID || stateRecord.WorkspaceID != project.WorkspaceID || stateRecord.ProjectID != project.ProjectID { ... }), but the only check on installation_id is request.InstallationID <= 0 (:794). The raw client value is persisted as the workspace's connection (:840).
  • Cross-tenant read primitive: internal/connectors/github/repositories.go:39 ListInstallationRepositories → internal/connectors/github/app.go:170 mints a token via POST /app/installations/{installationId}/access_tokens signed with the App JWT, succeeding for any installation where identrail's app is installed.

The feature-flagged V2 path CompleteGitHubConnector (github_connect.go:447, default off) shares the gap and is additionally weaker (matches pending connector by state value alone with no caller-scope re-check); a single fix should cover both.

Intent proof

The code binds state to {TenantID, WorkspaceID, ProjectID} and re-verifies it at completion (:818), demonstrating it understands binding is required. The asymmetry — state bound, installation_id unbound — is the missed check.

Exploitation

  • Attacker is any authenticated identrail tenant; they call StartGitHubConnection for their own workspace and receive a state.
  • Attacker calls the completion route with {state: , installation_id: V} where V is a victim org's identrail GitHub App installation id (installation ids are not secret — they appear in post-install redirect URLs, webhook payloads, the org's GitHub App settings, and are enumerable integers).
  • CompleteGitHubConnection accepts (state matches attacker scope), ListInstallationRepositories(V) mints a token for V and lists the victim org's private repos, and the connection is persisted under the attacker's workspace.
  • Attacker now reads the victim org's private repository inventory and can drive posture scans/repo reads via their own workspace.

Impact: cross-tenant disclosure of another customer organization's private GitHub repositories and metadata.

Remediation

Bind installation_id with the same rigor as state: capture it from GitHub's signed post-install redirect (setup_url/callback_url) and pin it to the pending state at start time, and/or after minting verify the installation's account matches the org the initiating workspace is authorized for.

CVSS v3
8.5
EG Score
8.5HIGHlow confidence
EG Risk
38
EG Risk 38/100

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed (value × EchelonGraph’s weight)
Severity85% × 45%
The EG Score, 8.5 of 10.
Exploitation0% × 40%
No KEV listing, EG-KEV tier or EPSS when EchelonGraph scored this CVE.
Automatability0% × 15%
CISA's BOD 26-04 default: no one has published Automatable for this CVE, and CISA treats it as “no” for a CVE not in KEV.
SSVC (CISA's decision table, applied by EchelonGraph): Track at low or medium mission impact; Track* at high (mission-essential systems).
Exploitation none (no CISA value, KEV listing or exploit code on record) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). EchelonGraph holds no SSVC assessment of this CVE from CISA: none of these inputs is from Vulnrichment. EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE.
Action: A fix is available. Apply it within your standard update timelines.
EPSS PROB
—
EPSS %ILE
—
KEV
Not listed

SSVC (CISA's decision table, applied by EchelonGraph)Track at low or medium mission impact; Track* at high (mission-essential systems).

A fix is available. Apply it within your standard update timelines.

Exploitation none (no CISA value, KEV listing or exploit code on record) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). EchelonGraph holds no SSVC assessment of this CVE from CISA: none of these inputs is from Vulnrichment. EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE. Mission impact is CISA's Mission & Well-being decision point, and only you can judge it. CISA's table makes it high when Mission Prevalence is Essential — the vulnerable component "directly provides capabilities that constitute at least one MEF for at least one entity" (MEF: mission essential function) — or when Public Well-Being Impact is Irreversible: "multiple fatalities are likely", the cyber-physical system "is likely lost or destroyed", "extreme or serious externalities" are imposed on other parties, or social systems such as elections or the financial grid "are destabilized and potentially collapse". CISA's decision table

BOD 26-04 (CISA's remediation timeline, Table 1)14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.

In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). Where an input reads “CISA's BOD 26-04 default”, no one has published it for this CVE, and CISA's implementation guidance says: “If “Automatable” and “Technical Impact” information items about a CVE ID are not available and the CVE ID is not in the KEV Catalog, CISA will treat its values as “no” and “total,” respectively, until CISA or a third party provides metadata about the CVE ID. CISA will always provide the Vulnrichment data for a CVE ID listed in the KEV Catalog.” Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it

Published

September 9, 2026

Last Modified

September 9, 2026

Vendor Advisories for CVE-2026-59185(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(1 across 1 ecosystem)
Go(1)
PackageVulnerable rangeFix by version rangeDependents
github.com/identrail/identrail—
  • every version up to 1.0.2: fixed in 1.0.2
—

Data Freshness Timeline

(refreshed 4× in last 7d / 5× in last 30d)

Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. An arrow marks a change the record states ("CVSS v3 → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). Most recent first.

  1. 2026-10-12 15:52 UTCEG score recompute
  2. 2026-10-11 19:36 UTCEG score recompute
  3. 2026-10-11 16:51 UTCEG score recompute
  4. 2026-10-11 14:14 UTCEG score recompute
  5. 2026-09-29 04:32 UTCEG score recompute
  6. 2026-09-10 00:24 UTCEG score recomputeFirst assessed: 8.5 HIGH

Frequently asked(4)

What is CVE-2026-59185?
CVE-2026-59185 is a high-severity vulnerability; its CVE record was published on September 9, 2026. Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the…
When was the CVE record for CVE-2026-59185 published?
The CVE record for CVE-2026-59185 was published on September 9, 2026. That is the record's publication date; the vulnerability itself may have been made public earlier. EchelonGraph's copy of the record carries a last-modified date of September 9, 2026; the record at its source may have been updated since.
What is the CVSS score of CVE-2026-59185?
CVE-2026-59185 has a CVSS base score of 8.5 (the CNA's own assessment, by github_m; NVD's own analysis pending). The EG score is currently aggregating — additional source signals are being incorporated as they become available..
How do I remediate CVE-2026-59185?
A fix for CVE-2026-59185 is available: update to the fixed version the vendor names in its advisory. The vendor advisories EchelonGraph has for CVE-2026-59185 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-59185

Explore →

Is Your Infrastructure Affected by CVE-2026-59185?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs