{"id":"GHSA-pf56-329r-95rw","revision":null,"records":[{"revision":"da1ea389d4c449b8bb10264eec0b3c3a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-59891","aliases":[],"title":"Credential confusion in \u00A0@sigstore/oci\u00A0 can leak registry credentials to an attacker-controlled registry","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.","state":0,"publishedAt":"2026-07-14T16:54:50.608+00:00","modifiedAt":"2026-07-21T18:43:52.659+00:00","affected":[{"ecosystem":"Vendor product","name":"sigstore-js","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"sigstore\",\n                    \"product\": \"sigstore-js\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.7.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw","https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89","https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59891","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-59891","identifiers":["CVE-2026-59891"]},"retained":false,"historicalAffected":[]},{"revision":"a14eec1a0f0d4d158ad74e7eab843b64","observedAt":"2026-10-25T14:19:22.811+00:00","statement":{"source":"nvd","id":"CVE-2026-59891","aliases":[],"title":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contai…","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.","state":0,"publishedAt":"2026-07-14T17:17:15.27+00:00","modifiedAt":"2026-10-24T21:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6,"severity":"CRITICAL"}],"references":["https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89","https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1","https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59891","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-522"],"productCriteria":[],"sourceDates":{"published":"2026-07-14T17:17:15.270","lastModified":"2026-10-24T21:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-59891","identifiers":["CVE-2026-59891"]},"retained":false,"historicalAffected":[]},{"revision":"505dca649cae443bbda746165cb056eb","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-pf56-329r-95rw","aliases":["CVE-2026-59891"],"title":"Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry","description":"### Impact\n\nThis is a credential-exposure / credential-confusion issue.\n\n`getRegistryCredentials()` reads credentials from the Docker config file (`~/.docker/config.json`) and selects an entry by checking whether any configured auth key **contains** the target registry string:\n\n```js\nObject.keys(dockerConfig.auths || {}).find((key) => key.includes(registry))\n```\n\nBecause this is a **substring match rather than an exact host match**, credentials configured for one registry can be selected for — and transmitted to — a *different* registry whose hostname has a substring relationship with a configured auth key (for example, an attacker-controlled `cr.io` matches a configured `ghcr.io`).\n\n**Who is impacted:** Any consumer of `@sigstore/oci` that uploads artifacts to an OCI registry using credentials from a Docker config, where the destination registry/image reference can be influenced by an untrusted party. This includes `@actions/attest` and the `actions/attest`, `actions/attest-build-provenance`, and `actions/attest-sbom` GitHub Actions when run with `push-to-registry: true`, where the `subject-name` input determines the destination registry.\n\nThis is classified as a **critical** vulnerability given the potential, in a theoretical worst-case scenario, to expose long-lived registry credentials. However, in practice, exploitation requires all of the following:\n\n- The Docker config on the host contains credentials for a registry.\n- The destination registry/image reference is influenced by an untrusted source.\n- The attacker controls a registry whose hostname is a substring of (or is otherwise contained within) a configured Docker auth key.\n\nUnder those conditions, registry credentials present on the host (e.g. a GHCR, Docker Hub, or cloud-registry token) can be sent to an attacker-controlled registry during the authentication exchange.\n\n### Patches\n\nFixed in **`@sigstore/oci@0.7.1`**. Credential selection now requires an **exact host match**: both the target registry and each Docker auth key are canonicalized — stripping any `https?://` scheme and path and normalizing the Docker Hub aliases (`index.docker.io` / `registry-1.docker.io` / `docker.io`) — and compared for equality. When no exact match exists, credential lookup now fails rather than falling back to an unrelated credential.\n\n- **Affected versions:** `<= 0.7.0` (all releases from `0.1.0`).\n- **Patched version:** `0.7.1`.\n\nDownstream consumers should pick up the patched `@sigstore/oci`; subsequent releases of `@actions/attest` and the `actions/attest*` GitHub Actions will bundle the fix.\n\n### Workarounds\n\n- Treat the destination registry/image reference as trusted input — do not allow untrusted sources to influence the registry/image reference passed to `@sigstore/oci` (or the `subject-name` of `actions/attest*` when `push-to-registry: true`).\n- Limit the credentials available in the host's Docker config to only those required for the operation, and avoid authenticating to registries whose hostnames have substring relationships with potential untrusted destinations.\n- Scope registry tokens narrowly and prefer short-lived credentials.","state":0,"publishedAt":"2026-07-21T19:34:05+00:00","modifiedAt":"2026-07-21T19:45:24.9909012+00:00","affected":[{"ecosystem":"npm","name":"@sigstore/oci","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.7.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw","https://nvd.nist.gov/vuln/detail/CVE-2026-59891","https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89","https://github.com/sigstore/sigstore-js","https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1"],"sourceUrl":"https://github.com/advisories/GHSA-pf56-329r-95rw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-pf56-329r-95rw","identifiers":["GHSA-pf56-329r-95rw","CVE-2026-59891"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T09:09:26.8428861+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T09:09:26.8428861+00:00","lastSuccessAt":"2026-10-27T09:09:27.2118469+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:27.2119981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-aabe25475865c7edee522f4302371edf7f08f4ba2936ed86dd9f3eab30c8198d","complete":true,"records":414888,"lastAttemptAt":"2026-10-27T09:09:26.1888005+00:00","lastSuccessAt":"2026-10-27T09:00:39.8201567+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.1888005+00:00","snapshotPublishedAt":"2026-10-27T08:33:34+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T09:09:33.2115253+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T09:09:26.8428861+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T09:09:26.8428861+00:00","lastSuccessAt":"2026-10-27T09:09:30.438867+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:30.4388678+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2f1de7fa5541453e964c3923e20a9f35","complete":true,"records":13416,"lastAttemptAt":"2026-10-27T09:09:31.2124779+00:00","lastSuccessAt":"2026-10-27T09:03:12.991+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:03:12.991+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13477},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T09:09:26.6530761+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.6530761+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T09:09:26.4482482+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.4482482+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-27T09:09:26.7642122+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.7642122+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-513066461af8d030bad8efab4fea81eabd246acd525512aa7469c95ccf02c320","complete":true,"records":230813,"lastAttemptAt":"2026-10-27T09:09:26.5496184+00:00","lastSuccessAt":"2026-10-27T09:02:44.9044939+00:00","error":null,"lastVerifiedAt":"2026-10-27T09:09:26.5496184+00:00","snapshotPublishedAt":"2026-10-27T08:48:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}