Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-59891— Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry

CVSS 9.6 · Critical EPSS 0.32% · P24

Possible ATT&CK Techniques 1AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProductVersion RangeStatus
sigstoresigstore-js< 0.7.1affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-59891

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry
Source: NVD (National Vulnerability Database)
Vulnerability Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
不充分的凭证保护机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
sigstore sigstore-js 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
sigstore sigstore-js是美国sigstore组织的一个JavaScript签名服务库。 sigstore sigstore-js 0.7.1之前版本存在信任管理问题漏洞，该漏洞源于getRegistryCredentials()读取Docker配置文件时使用子字符串匹配而非精确主机匹配来选择凭证，可能导致为某个registry配置的凭证被发送给其他registry。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
sigstoresigstore-js < 0.7.1 -

II. Public POCs for CVE-2026-59891

#POC DescriptionSource LinkShenlong Link
AI-Generated POCVerified env Premium
Qwen3.6-35B-A3B · 15785 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-59891

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-59891 (1)

Vendor Advisories for CVE-2026-59891 (1)

Vendor Pages for CVE-2026-59891 (1)

Same Patch Batch · sigstore · 2026-07-14 · 4 CVEs total

CVE-2026-488157.5 HIGHsigstore-js: `certificateOIDs` verification constraints are silently dropped and never enf
CVE-2026-488166.5 MEDIUMsigstore-js: Insufficient Verification of Data Authenticity
CVE-2026-487585.4 MEDIUMsigstore-js: DSSE payloadType type-binding failure

IV. Related Vulnerabilities

Same product: sigstore-js
Same vendor: sigstore
Same weakness: CWE-522

V. Comments for CVE-2026-59891

No comments yet

Leave a comment