CVE-2026-105165 in secrets-replicator
Summary
by MITRE • 10/05/2026
A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb. It is suggested to upgrade the affected component.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/05/2026
The vulnerability identified in devopspolis secrets-replicator versions up to 0.4.0 represents a critical flaw within the AssumeRole Handler component, specifically located in the process_single_secret function found in src/handler.py. This issue stems from improper validation or handling of the external_id argument passed during AWS Security Token Service role assumption operations. In cloud-native environments where secrets replication is automated, such handlers are responsible for assuming IAM roles to access sensitive data across accounts or regions. The flaw allows an attacker who can influence the input parameters of this function to manipulate the external_id value in a way that bypasses intended security controls. This manipulation leads to incorrect permission assignment, potentially granting the replicator service broader privileges than originally configured by the system administrator.
From a technical perspective, the AWS STS AssumeRole API utilizes the ExternalId parameter as an optional but recommended safeguard against confused deputy problems. When properly implemented, this ID ensures that only requests originating from authorized sources with the correct external identifier can assume the role. However, in versions up to 0.4.0 of secrets-replicator, the logic governing how this argument is processed fails to enforce strict validation or context-aware checks. Consequently, if an attacker can inject or alter the external_id value through a remote vector, they may trick the service into assuming a role with elevated permissions that were not intended for that specific execution context. This misconfiguration effectively undermines the principle of least privilege, allowing potential escalation of access rights within the AWS environment.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of the affected component. Since secrets-replicator typically handles sensitive credentials such as database passwords, API keys, or encryption certificates, an attacker gaining unauthorized elevated permissions could exfiltrate these critical assets. This leads directly to confidentiality breaches across multiple AWS accounts that rely on this replication mechanism for secret synchronization. Furthermore, if the assumed role has write access to other resources, the attacker might modify configurations, deploy malicious workloads, or establish persistence mechanisms within the cloud infrastructure. The ability to execute attacks remotely means that no local network proximity is required, significantly expanding the attack surface and increasing the risk of widespread compromise across interconnected systems.
This vulnerability aligns with CWE-20 Improper Input Validation, as the core issue lies in the failure to adequately sanitize or verify the external_id parameter before it influences permission logic. Additionally, it relates to CWE-732 Incorrect Permission Assignment for Critical Resource, reflecting the outcome where access rights are granted incorrectly due to flawed input handling. In terms of adversarial tactics, this flaw facilitates ATT&CK technique T1098.004 SSH Authorized Key Manipulation if used in conjunction with other vectors, but more accurately maps to AWS-specific techniques such as T1528 Steal Application Access Token or T1556 Modify Cloud Credentials for lateral movement and privilege escalation within cloud environments. The remote nature of the exploit also touches upon aspects of network-based attacks where input injection is leveraged to alter system behavior.
To mitigate this risk, immediate action is required by upgrading devopspolis secrets-replicator to version 0.5.0 or later, which includes the patch identified as b42239405fbf4fae3c3f0048fc0b4225112edceb. This update corrects the logic within the process_single_secret function to ensure that external_id values are validated against expected formats and contexts before being used in role assumption requests. Organizations should also audit their current IAM policies to ensure that roles assumed by secrets-replicator do not possess overly broad permissions, adhering strictly to least privilege principles even while awaiting upgrades. Implementing network-level controls such as VPC endpoints with strict access policies can further limit exposure if the vulnerability is exploited in a live environment. Regular security assessments and code reviews focusing on input validation for cloud service integrations are recommended to prevent similar issues in future development cycles.