{"id":"CVE-2026-59891","summary":"Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry","details":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.","aliases":["GHSA-pf56-329r-95rw"],"modified":"2026-10-28T02:30:47.331893168Z","published":"2026-07-14T16:54:50.608Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-522"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59891.json"},"references":[{"type":"WEB","url":"https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59891.json"},{"type":"ADVISORY","url":"https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59891"},{"type":"FIX","url":"https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sigstore/sigstore-js","events":[{"introduced":"0"},{"fixed":"d406ea60b342ca37cdeecd7afedb992cd189db92"},{"fixed":"85c58380758b97ce1b74ef470e55cc21f9d3aa89"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"0.7.1"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"85c58380758b97ce1b74ef470e55cc21f9d3aa89"}]}]}}],"versions":["sigstore@5.0.0","@sigstore/verify@4.0.0","@sigstore/tuf@5.0.0","@sigstore/sign@5.0.0","@sigstore/rekor-types@5.0.0","@sigstore/oci@0.7.0","@sigstore/mock@0.13.0","@sigstore/core@4.0.0","@sigstore/cli@0.10.0","@sigstore/bundle@5.0.0","sigstore@4.1.1","@sigstore/verify@3.1.1","@sigstore/mock@0.12.1","@sigstore/core@3.2.1","@sigstore/tuf@4.0.2","@sigstore/sign@4.1.1","@sigstore/oci@0.6.1","@sigstore/mock@0.12.0","@sigstore/core@3.2.0","@sigstore/cli@0.9.1","sigstore@4.1.0","@sigstore/sign@4.0.1","sigstore@4.0.0","@sigstore/verify@3.0.0","@sigstore/tuf@4.0.0","@sigstore/sign@4.0.0","@sigstore/rekor-types@4.0.0","@sigstore/oci@0.6.0","@sigstore/mock@0.11.0","@sigstore/core@3.0.0","@sigstore/cli@0.9.0","@sigstore/bundle@4.0.0","@sigstore/verify@2.1.1","@sigstore/tuf@3.1.1","@sigstore/oci@0.5.0","@sigstore/cli@0.8.2","sigstore@3.1.0","@sigstore/verify@2.1.0","@sigstore/tuf@3.1.0","@sigstore/sign@3.1.0","@sigstore/mock@0.10.0","@sigstore/bundle@3.1.0","@sigstore/mock@0.9.0","sigstore@3.0.0","@sigstore/verify@2.0.0","@sigstore/tuf@3.0.0","@sigstore/sign@3.0.0","@sigstore/rekor-types@3.0.0","@sigstore/oci@0.4.0","@sigstore/mock@0.8.0","@sigstore/core@2.0.0","@sigstore/cli@0.8.1","@sigstore/bundle@3.0.0","@sigstore/oci@0.3.7","@sigstore/oci@0.3.6","@sigstore/oci@0.3.5","@sigstore/mock@0.7.5","@sigstore/oci@0.3.4","sigstore@2.3.1","@sigstore/verify@1.2.1","@sigstore/tuf@2.3.4","@sigstore/sign@2.3.2","@sigstore/oci@0.3.3","@sigstore/mock@0.7.4","@sigstore/bundle@2.3.2","@sigstore/oci@0.3.2","@sigstore/tuf@2.3.3","@sigstore/sign@2.3.1","@sigstore/oci@0.3.1","@sigstore/mock@0.7.3","@sigstore/cli@0.8.0","sigstore@2.3.0","@sigstore/verify@1.2.0","@sigstore/bundle@2.3.1","@sigstore/sign@2.3.0","@sigstore/oci@0.3.0","@sigstore/mock@0.7.2","@sigstore/cli@0.7.1","@sigstore/bundle@2.3.0","@sigstore/verify@1.1.1","@sigstore/tuf@2.3.2","@sigstore/mock@0.7.1","@sigstore/core@1.1.0","@sigstore/oci@0.2.0","@sigstore/mock@0.7.0","@sigstore/cli@0.7.0","sigstore@2.2.2","@sigstore/verify@1.1.0","@sigstore/tuf@2.3.1","@sigstore/sign@2.2.3","@sigstore/mock@0.6.5","@sigstore/bundle@2.2.0","@sigstore/oci@0.1.0","sigstore@2.2.1","@sigstore/verify@1.0.0","@sigstore/sign@2.2.2","@sigstore/mock@0.6.4","@sigstore/core@1.0.0","sigstore@2.2.0","@sigstore/verify@0.1.0","@sigstore/tuf@2.3.0","@sigstore/sign@2.2.1","@sigstore/mock@0.6.3","@sigstore/core@0.2.0","@sigstore/cli@0.6.0","@sigstore/bundle@2.1.1","@sigstore/mock@0.6.2","@sigstore/core@0.1.0","@sigstore/sign@2.2.0","@sigstore/mock@0.6.1","@sigstore/cli@0.5.0","@sigstore/mock@0.6.0","@sigstore/cli@0.4.0","@sigstore/tuf@2.2.0","@sigstore/mock@0.5.0","@sigstore/cli@0.3.0","sigstore@2.1.0","@sigstore/tuf@2.1.0","@sigstore/sign@2.1.0","@sigstore/mock@0.4.0","@sigstore/cli@0.2.1","@sigstore/bundle@2.1.0","sigstore@2.0.0","@sigstore/tuf@2.0.0","@sigstore/sign@2.0.0","@sigstore/rekor-types@2.0.0","@sigstore/mock@0.3.0","@sigstore/cli@0.2.0","@sigstore/bundle@2.0.0","sigstore@1.9.0","@sigstore/sign@1.0.0","@sigstore/mock@0.2.0","@sigstore/cli@0.1.2","@sigstore/bundle@1.1.0","sigstore@1.8.0","@sigstore/tuf@1.0.3","@sigstore/mock@0.1.1","@sigstore/cli@0.1.1","@sigstore/bundle@1.0.0","@sigstore/tuf@1.0.2","sigstore@1.7.0","@sigstore/tuf@1.0.1","@sigstore/mock@0.1.0","sigstore@1.6.0","@sigstore/tuf@1.0.0","@sigstore/rekor-types@1.0.0","@sigstore/cli@0.1.0","@sigstore/rekor-types@0.0.3","@sigstore/cli@0.0.5","sigstore@1.5.2","@sigstore/cli@0.0.4","@sigstore/cli@0.0.3","sigstore@1.5.1","@sigstore/rekor-types@0.0.2","@sigstore/cli@0.0.2","v1.5.0","v1.4.0","v1.3.2","v1.3.1","v1.3.0","v1.2.0","v1.1.1","v1.1.0","v1.0.0","v1.0.0-beta.1","v0.4.0","v0.3.0","v0.2.0","v0.1.1","v0.1.0","v0.0.1-alpha.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59891.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}