CVE-2026-59891 Details
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.
A vulnerability in the `@sigstore/oci` package prior to version 0.7.1 allows for credential confusion when authenticating to Docker registries. The `getRegistryCredentials()` function selects credentials based on a substring match of the registry name, which can lead to unintended credential leakage to an attacker-controlled registry. This issue affects users who upload artifacts to an OCI registry using Docker config credentials, particularly when the destination registry is influenced by an untrusted source.
Users should update to `@sigstore/oci` version 0.7.1 or later, where this vulnerability has been fixed by implementing exact host matching for registry credentials. Additionally, it's recommended to review and limit the Docker credentials stored in the host's Docker config, avoiding authentication to registries with substring relationships to untrusted destinations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |