Octo STS prior to 0.11.2 exposes the internal configuration of trust policies to callers whose OIDC token fails the policy check. The error messages include issuer, subject, audience values, claim_pattern names, regular expressions, and policy app or pin selection results, revealing details such as repository names, branches, environments, or cloud account identifiers even when the policy resides in a private repository. This vulnerability does not allow token minting or bypassing a trust policy; it only leaks configuration information.

The affected product is Octo STS for self‑hosted deployments; all versions earlier than 0.11.2 are susceptible. The CNA identifies the vendor/product as octo‑sts:app. No downstream applications are directly impacted beyond any services communicating with the Octo STS Exchange endpoint.

The CVSS score of 5.3 reflects a moderate severity issue. EPSS data is not available, so the likelihood of exploitation is uncertain, and the vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit the issue by presenting a valid OIDC token that does not meet the trust policy; Exchange then returns verbose PermissionDenied errors that disclose the policy. Once the product is upgraded to version 0.11.2, the error message is sanitized to a generic PermissionDenied response, eliminating the information leakage.