CVE-2026-105165: devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment
A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
devopspolis secrets-replicatorto a version that resolves this vulnerability.Fixed in 0.5.0Patch b42239405fbf4fae3c3f0048fc0b4225112edceb
Event History
Frequently Asked Questions
Which releases should be treated as affected?
devopspolis secrets-replicator versions up to and including 0.4.0 are affected. Version 0.5.0 is recommended to address the issue.
What access does an attacker need to exploit this issue?
The vulnerability can be exploited remotely and requires low privileges. Exploitation involves manipulating the external_id argument handled by process_single_secret in the AssumeRole handler.
What is the security impact?
Successful exploitation can result in incorrect permission assignment. The reported impact includes limited effects on confidentiality, integrity, and availability.
What should teams do if they are running an affected release?
Upgrade the affected component to version 0.5.0. The referenced patch is b42239405fbf4fae3c3f0048fc0b4225112edceb.