Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-59891 · Microsoft / collected KEV context

GHSA-pf56-329r-95rw

cve-program · CVE-2026-59891

• https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw
• https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89
• https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1

nvd · CVE-2026-59891

• https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89
• https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1
• https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw

osv · GHSA-pf56-329r-95rw

• https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw
• https://nvd.nist.gov/vuln/detail/CVE-2026-59891
• https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89
• https://github.com/sigstore/sigstore-js
• https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1

No related operational record is retained in the current change model.