CVE-2026-59185 is a high-severity (CVSS 8.5) vulnerability in github.com/identrail/identrail. O3 Security confirms whether CVE-2026-59185 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification
Real-World Exposure
github.com/identrail/identrailReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
identrail's GitHub App connection-completion endpoint binds a fully client-supplied installation_id to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installation access token for the supplied installation_id using the app's own JWT, so an authenticated tenant can link any other identrail customer's GitHub App installation into their own workspace and read that victim organization's private repositories.
Affected code (default-on path, no feature flag)
- Route:
internal/api/router.go:3590—POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete.installation_idis read from the JSON body or the attacker-controlledX-GitHub-Installation-IDheader (router.go:3582-3588). - Service:
internal/api/github_connect.go:781CompleteGitHubConnection. Thestatetoken IS rigorously bound to the caller's scope (github_connect.go:818:if stateRecord.TenantID != scope.TenantID || stateRecord.WorkspaceID != project.WorkspaceID || stateRecord.ProjectID != project.ProjectID { ... }), but the only check oninstallation_idisrequest.InstallationID <= 0(:794). The raw client value is persisted as the workspace's connection (:840). - Cross-tenant read primitive:
internal/connectors/github/repositories.go:39ListInstallationRepositories→internal/connectors/github/app.go:170mints a token viaPOST /app/installations/{installationId}/access_tokenssigned with the App JWT, succeeding for any installation where identrail's app is installed.
The feature-flagged V2 path CompleteGitHubConnector (github_connect.go:447, default off) shares the gap and is additionally weaker (matches pending connector by state value alone with no caller-scope re-check); a single fix should cover both.
Intent proof
The code binds state to {TenantID, WorkspaceID, ProjectID} and re-verifies it at completion (:818), demonstrating it understands binding is required. The asymmetry — state bound, installation_id unbound — is the missed check.
Exploitation
- Attacker is any authenticated identrail tenant; they call
StartGitHubConnectionfor their own workspace and receive astate. - Attacker calls the completion route with
{state: <their state>, installation_id: V}where V is a victim org's identrail GitHub App installation id (installation ids are not secret — they appear in post-install redirect URLs, webhook payloads, the org's GitHub App settings, and are enumerable integers). CompleteGitHubConnectionaccepts (state matches attacker scope),ListInstallationRepositories(V)mints a token for V and lists the victim org's private repos, and the connection is persisted under the attacker's workspace.- Attacker now reads the victim org's private repository inventory and can drive posture scans/repo reads via their own workspace.
Impact: cross-tenant disclosure of another customer organization's private GitHub repositories and metadata.
Remediation
Bind installation_id with the same rigor as state: capture it from GitHub's signed post-install redirect (setup_url/callback_url) and pin it to the pending state at start time, and/or after minting verify the installation's account matches the org the initiating workspace is authorized for.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/identrail/identrail | all versions | 1.0.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/identrail/identrail. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/identrail/identrail to 1.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-59185 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-59185 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-59185. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-59185 in your dependencies?
O3 detects CVE-2026-59185 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.