Skip to content

Fix false positive where GitHub Actions subject was not recognized#118

Merged
jbarciabf merged 2 commits intoBishopFox:mainfrom
prdngr:fix-privesc-false-positive
Mar 4, 2026
Merged

Fix false positive where GitHub Actions subject was not recognized#118
jbarciabf merged 2 commits intoBishopFox:mainfrom
prdngr:fix-privesc-false-positive

Conversation

@prdngr
Copy link
Copy Markdown
Contributor

@prdngr prdngr commented Feb 9, 2026

Hi, this PR fixes a false positive in cape and role-trusts. In situations where the AWS trust policy of a GitHub Actions OIDC role verifies the sub claim, as shown below, CloudFox reported the trusted subject as "ALL REPOS!!!".

"Condition": {
    "ForAllValues:StringLike": {
        "token.actions.githubusercontent.com:sub": "repo:BishopFox/cloudfox:*"
    },
    [...]
}

@jbarciabf jbarciabf self-assigned this Mar 4, 2026
@jbarciabf jbarciabf added the bug Something isn't working label Mar 4, 2026
@jbarciabf jbarciabf merged commit db8a689 into BishopFox:main Mar 4, 2026
@prdngr prdngr deleted the fix-privesc-false-positive branch March 4, 2026 15:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants