Description
A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb. It is suggested to upgrade the affected component.
Published: 2026-10-04
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Privilege Escalation via Incorrect Permission Assignment
Action: Apply Patch
AI Analysis

Impact

A flaw in the AssumeRole handler allows an attacker to supply a crafted external_id value, causing the component to grant permissions that it should not. This incorrect permission assignment can elevate privileges and allow unauthorized access to resources.

Affected Systems

The vulnerability affects devopspolis secrets‑replicator versions up to 0.4.0. Packages marked with the devopspolis:secrets‑replicator identifier are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 classifies the issue as medium severity. No EPSS score is published and the vulnerability is not currently listed in CISA KEV. The flaw can be exploited remotely, likely via API calls that include the manipulated external_id parameter. Because the flaw is not a code execution path, the risk primarily involves improper authorization rather than a broader compromise.

Generated by OpenCVE AI on October 4, 2026 at 23:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade devopspolis secrets‑replicator to version 0.5.0 or later, which removes the vulnerable code path.
  • Restrict the external_id parameter in the process_single_secret call to a whitelist of expected values or enforce strict validation.
  • Monitor and audit assume‑role events for unexpected permission grants, and adjust logging to detect misuse.

Generated by OpenCVE AI on October 4, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 04 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb. It is suggested to upgrade the affected component.
Title devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment
First Time appeared Devopspolis
Devopspolis secrets-replicator
Weaknesses CWE-275
CWE-732
CPEs cpe:2.3:a:devopspolis:secrets-replicator:*:*:*:*:*:*:*:*
Vendors & Products Devopspolis
Devopspolis secrets-replicator
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Devopspolis Secrets-replicator
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-04T22:15:17.061Z

Reserved: 2026-10-04T08:00:27.913Z

Link: CVE-2026-105165

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-04T23:16:58.180

Modified: 2026-10-04T23:16:58.180

Link: CVE-2026-105165

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-04T23:30:21Z

Weaknesses
  • CWE-275
  • CWE-732

    Incorrect Permission Assignment for Critical Resource