Octo STS versions before 0.11.2 contain a vulnerability where error messages expose sensitive trust policy configuration details. Specifically, when an OIDC token does not satisfy a trust policy, the error messages returned include issuer, subject, audience values, claim pattern names, and regular expressions. This information disclosure can reveal internal repository names, branches, environments, or cloud account identifiers. The vulnerability does not allow token minting or bypassing the trust policy. The issue is fixed in version 0.11.2.