{"id":"GHSA-7cxh-94cf-mfp6","revision":null,"records":[{"revision":"5105170d085b458e8ad269e41b43ae67","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-77564","aliases":[],"title":"Talos Linux: Support bundle does not redact registry credentials","description":"Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.","state":0,"publishedAt":"2026-10-14T16:09:11.33+00:00","modifiedAt":"2026-10-14T16:09:11.33+00:00","affected":[{"ecosystem":"Vendor product","name":"talos","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siderolabs\",\n                    \"product\": \"talos\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.12.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.13.0, < 1.13.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","score":3.3,"severity":"LOW"}],"references":["https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6","https://github.com/siderolabs/talos/pull/13345","https://github.com/siderolabs/talos/pull/13434","https://github.com/siderolabs/talos/pull/13611","https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142","https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e","https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb","https://github.com/siderolabs/talos/releases/tag/v1.12.9","https://github.com/siderolabs/talos/releases/tag/v1.13.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-77564","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-77564","identifiers":["CVE-2026-77564"]},"retained":false,"historicalAffected":[]},{"revision":"50a8f07c678046b7bf4c8afd21fc1ea8","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-77564","aliases":[],"title":"Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos…","description":"Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.","state":0,"publishedAt":"2026-10-14T17:19:11.437+00:00","modifiedAt":"2026-10-16T16:00:33.533+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","score":3.3,"severity":"LOW"}],"references":["https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142","https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e","https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb","https://github.com/siderolabs/talos/pull/13345","https://github.com/siderolabs/talos/pull/13434","https://github.com/siderolabs/talos/pull/13611","https://github.com/siderolabs/talos/releases/tag/v1.12.9","https://github.com/siderolabs/talos/releases/tag/v1.13.3","https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77564","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-312"],"productCriteria":[],"sourceDates":{"published":"2026-10-14T17:19:11.437","lastModified":"2026-10-16T16:00:33.533"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-77564","identifiers":["CVE-2026-77564"]},"retained":false,"historicalAffected":[]},{"revision":"f59b2ace88e2433690e957e69b3ad1d7","observedAt":"2026-10-26T15:37:07.911+00:00","statement":{"source":"osv","id":"GHSA-7cxh-94cf-mfp6","aliases":["CVE-2026-77564"],"title":"Talos Linux: Support bundle does not redact registry credentials","description":"### Summary\nWhen generating a support bundle with `talosctl support` the credentials entered for private registries are included in the bundle.\n\n\n### Details\n\nWithin the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.\nThe same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.\n\n### PoC\n\nSimply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource \n\n### Impact\n\nThe problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.\n\nIn most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly.\n\n\n### Notes\n\nTalos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower.\n\n### Environment\n\n- Talos version: v1.13.0\n- Kubernetes version: 1.35.3\n- Platform: amd64","state":0,"publishedAt":"2026-10-15T20:20:16+00:00","modifiedAt":"2026-10-26T14:45:05.6849764+00:00","affected":[{"ecosystem":"Go","name":"github.com/siderolabs/talos","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.14.0-alpha.0.0.20260513110206-76080416beee"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6","https://nvd.nist.gov/vuln/detail/CVE-2026-77564","https://github.com/siderolabs/talos/pull/13345","https://github.com/siderolabs/talos/pull/13434","https://github.com/siderolabs/talos/pull/13611","https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142","https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e","https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb","https://github.com/siderolabs/talos","https://github.com/siderolabs/talos/releases/tag/v1.12.9","https://github.com/siderolabs/talos/releases/tag/v1.13.3"],"sourceUrl":"https://github.com/advisories/GHSA-7cxh-94cf-mfp6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7cxh-94cf-mfp6","identifiers":["GHSA-7cxh-94cf-mfp6","CVE-2026-77564"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T19:48:20.2022313+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T19:48:20.2022313+00:00","lastSuccessAt":"2026-10-27T19:48:20.3995122+00:00","error":null,"lastVerifiedAt":"2026-10-27T19:48:20.3995159+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-7cd07bd34af12feff0c266ac6b6067983cd304c0b7a53edb5f19b42fc0b28494","complete":true,"records":415364,"lastAttemptAt":"2026-10-27T19:46:06.1518767+00:00","lastSuccessAt":"2026-10-27T19:46:06.0285436+00:00","error":null,"lastVerifiedAt":"2026-10-27T19:46:06.1518767+00:00","snapshotPublishedAt":"2026-10-27T19:18:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3c3fdf72295742c7a66e189e2b63cb9e","complete":false,"records":5734,"lastAttemptAt":"2026-10-27T20:00:28.3741297+00:00","lastSuccessAt":"2026-10-27T20:00:28.37+00:00","error":null,"lastVerifiedAt":"2026-10-27T20:00:28.37+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":1000,"expectedIdentifiers":13501,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T19:48:20.2022313+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T19:48:20.2022313+00:00","lastSuccessAt":"2026-10-27T19:48:20.4010872+00:00","error":null,"lastVerifiedAt":"2026-10-27T19:48:20.4010877+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3bd7ce170fa9469593b2b05a4c145743","complete":true,"records":13438,"lastAttemptAt":"2026-10-27T19:48:21.6831828+00:00","lastSuccessAt":"2026-10-27T19:48:21.679+00:00","error":null,"lastVerifiedAt":"2026-10-27T19:48:21.679+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13501,"expectedIdentifiers":13501,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0a9352f15ff9b42ef0668815b17985da54b0862a5d24cb9a13f2a99c14c0f811","complete":true,"records":9785,"lastAttemptAt":"2026-10-27T19:48:20.0598535+00:00","lastSuccessAt":"2026-10-27T19:48:19.7606489+00:00","error":null,"lastVerifiedAt":"2026-10-27T19:48:20.0598535+00:00","snapshotPublishedAt":"2026-10-27T19:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T19:46:06.3074736+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T19:46:06.3074736+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-3a5b306d60fc44677a03a8afc99d87e6c5402770ef68d560f94a8c3ad3802b75","complete":true,"records":3001,"lastAttemptAt":"2026-10-27T19:48:20.1662846+00:00","lastSuccessAt":"2026-10-27T16:45:49.0050993+00:00","error":null,"lastVerifiedAt":"2026-10-27T19:48:20.1662846+00:00","snapshotPublishedAt":"2026-10-27T16:33:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-fc1c62e1c2d70dda08a497ed7a59029d5d84def9eb7702ebf314b9dadea06e2f","complete":true,"records":230836,"lastAttemptAt":"2026-10-27T19:48:10.3426958+00:00","lastSuccessAt":"2026-10-27T19:48:08.9643671+00:00","error":null,"lastVerifiedAt":"2026-10-27T19:48:10.3426958+00:00","snapshotPublishedAt":"2026-10-27T19:18:16+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}