{"id":"CVE-2026-118763","kind":"vulnerability","aliases":["CVE-2026-118763"],"related":[],"title":"sigstore-js: registry upload can leak credentials to attacker-chosen host","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while RegistryClient.uploadBlob() sends a fresh PUT to an absolute blob-upload Location supplied by the registry without checking that its origin or scheme matches the registry. A malicious or compromised registry can therefore direct a user pushing an artifact through attachArtifactToImage() to an attacker-controlled host and receive the registry bearer token, Basic credentials, or custom authentication headers. Redirect-time header stripping does not prevent the leak because the cross-host PUT is a new explicit request rather than a followed redirect. This is a residual of CVE-2026-59891, whose fix changed credential selection in credentials.ts but did not constrain where credentials are sent from registry.ts. Version 0.7.2 fixes the issue by separating registry credentials from client-wide defaults and sending them only to the registry origin.","summary":"sigstore-js is a JavaScript library for Sigstore signing services. A malicious or compromised container registry can redirect an artifact upload to an attacker host, which then receives the registry's bearer token, Basic credentials or custom auth headers.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci-cd","container-registry","npm","package","sigstore-js"],"not_affected_if":["no-attachartifacttoimage-use","trusted-registry-only"],"how_to_check":"- Check the installed version of `sigstore` or `@sigstore/oci` with `npm ls @sigstore/oci sigstore` and look for anything below `0.7.2`.\n- Search lockfiles for `@sigstore/oci` to find transitive copies.\n- Look for calls to `attachArtifactToImage()` in your code or CI scripts.","fix":null,"status":"open","published_at":"2026-10-29T17:18:07+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","triaged_at":"2026-10-29T17:27:53+00:00","updated_at":"2026-10-29T17:27:53+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T17:27:53Z","model":"claude-haiku-5-5","output":{"fix":"- `@sigstore/oci` and the `sigstore-js` packages: move to `0.7.2` or later, which separates registry credentials from client-wide defaults and sends them only to the registry origin.","reach":"network","title":"sigstore-js: registry upload can leak credentials to attacker-chosen host","impact":"high","summary":"sigstore-js is a JavaScript library for Sigstore signing services. A malicious or compromised container registry can redirect an artifact upload to an attacker host, which then receives the registry's bearer token, Basic credentials or custom auth headers.","audience":"developers","category":"package","nicknames":[],"who_cares":["sigstore-js","npm","container-registry","ci-cd"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"registry bearer token and Basic credentials sent to attacker host","analyst_note":"","how_to_check":"- Check the installed version of `sigstore` or `@sigstore/oci` with `npm ls @sigstore/oci sigstore` and look for anything below `0.7.2`.\n- Search lockfiles for `@sigstore/oci` to find transitive copies.\n- Look for calls to `attachArtifactToImage()` in your code or CI scripts.","plain_action":"","needs_analyst":false,"not_affected_if":["no-attachartifacttoimage-use","trusted-registry-only"],"who_is_affected":"Teams that use sigstore-js to attach artifacts to container images in a registry, typically in build or signing pipelines. The exposure needs a registry that is malicious or compromised, since the registry supplies the upload location, so teams that never call attachArtifactToImage() or that only use trusted, self-controlled registries are at lower risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4386,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118763':16A,19A '-2026':15A,18A,197C '-59891':198C '0.7.2':84C,217C 'absolut':113C 'artifact':51B,144C 'attachartifacttoimag':146C 'attack':11A,55B,150C 'attacker-chosen':10A 'attacker-control':149C 'auth':69B 'authent':163C 'author':93C 'basic':65B,159C 'bearer':63B,157C 'blob':115C 'blob-upload':114C 'cd':22B 'chang':201C 'check':123C 'chosen':12A 'ci':21B 'ci-cd':20B 'client':104C,227C 'client-wid':226C 'compromis':45B,135C 'configur':96C 'constrain':209C 'contain':24B,46B,86C 'container-registri':23B 'control':151C 'credenti':8A,66B,160C,202C,211C,224C 'credentials.ts':205C 'cross':178C 'cross-host':177C 'custom':68B,162C 'cve':14A,17A,196C 'default':99C,229C 'direct':139C 'docker':95C 'explicit':184C 'fix':200C,218C 'follow':189C 'fresh':109C 'header':70B,97C,164C,168C 'host':13A,56B,152C,179C 'http':103C 'interact':78C 'issu':220C 'javascript':36B,75C 'js':3A,30B,33B,73C 'leak':7A,174C 'librari':37B,76C 'locat':117C 'malici':43B,133C 'match':129C 'method':89C 'new':183C 'npm':26B 'origin':126C,237C 'packag':27B 'packages/oci/src/registry.ts':85C 'prevent':172C 'prior':82C 'provid':74C 'push':142C 'put':110C,180C 'rather':186C 'receiv':59B,154C 'redirect':49B,166C,190C 'redirect-tim':165C 'registri':4A,25B,47B,61B,92C,121C,131C,136C,156C,223C,236C 'registry.ts':215C 'registryclient.signin':88C 'registryclient.uploadblob':106C 'request':185C 'residu':194C 'scheme':128C 'select':203C 'send':107C,231C 'sent':213C 'separ':222C 'servic':41B,81C 'share':102C 'sign':40B 'sigstor':2A,29B,32B,39B,72C,80C 'sigstore-j':1A,28B,31B,71C 'store':91C 'strip':169C 'suppli':118C 'therefor':138C 'time':167C 'token':64B,158C 'upload':5A,52B,116C 'user':141C 'version':216C 'whose':199C 'wide':228C 'without':122C","nicknames":[],"mitigations":[],"who_affected":"Teams that use sigstore-js to attach artifacts to container images in a registry, typically in build or signing pipelines. The exposure needs a registry that is malicious or compromised, since the registry supplies the upload location, so teams that never call attachArtifactToImage() or that only use trusted, self-controlled registries are at lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T17:18:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118763","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118763","severity":null,"published_at":"2026-10-29T17:18:07+00:00","modified_at":"2026-10-29T17:18:07+00:00","first_seen_at":"2026-10-29T17:26:17+00:00","fetched_at":"2026-10-29T17:26:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}