CVE-2026-114075: Triggerdev Uat Minted Without Source Pat Binding
A delegated user-actor token (`tr_uat_` JWT) is minted without binding the id of the personal access token it derives from into the signed claims (`pat` claim). The token is stateless: with no `pat` claim the host cannot re-check the source PAT's liveness, so the delegated token survives revocation of its source PAT until expiry, and its capability cap canno
TSgreprules fetch cve-2026-114075-triggerdev-uat-minted-without-source-pat-binding --engine opengrepDescription
A delegated user-actor token (`tr_uat_` JWT) is minted without binding the id of the personal access token it derives from into the signed claims (`pat` claim). The token is stateless: with no `pat` claim the host cannot re-check the source PAT's liveness, so the delegated token survives revocation of its source PAT until expiry, and its capability cap canno
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.