---
id: "CVE-2026-118763"
kind: "vulnerability"
aliases: ["CVE-2026-118763"]
title: "sigstore-js: registry upload can leak credentials to attacker-chosen host"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci-cd", "container-registry", "npm", "package", "sigstore-js"]
not_affected_if: ["no-attachartifacttoimage-use", "trusted-registry-only"]
published_at: "2026-10-29T17:18:07+00:00"
first_seen_at: "2026-10-29T17:26:17+00:00"
updated_at: "2026-10-29T17:27:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118763", "first_seen_at": "2026-10-29T17:26:17+00:00"}]
---

# sigstore-js: registry upload can leak credentials to attacker-chosen host

sigstore-js is a JavaScript library for Sigstore signing services. A malicious or compromised container registry can redirect an artifact upload to an attacker host, which then receives the registry's bearer token, Basic credentials or custom auth headers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `sigstore` or `@sigstore/oci` with `npm ls @sigstore/oci sigstore` and look for anything below `0.7.2`.
- Search lockfiles for `@sigstore/oci` to find transitive copies.
- Look for calls to `attachArtifactToImage()` in your code or CI scripts.

## Timeline

- 2026-10-29T17:26:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118763

## From the sources

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while RegistryClient.uploadBlob() sends a fresh PUT to an absolute blob-upload Location supplied by the registry without checking that its origin or scheme matches the registry. A malicious or compromised registry can therefore direct a user pushing an artifact through attachArtifactToImage() to an attacker-controlled host and receive the registry bearer token, Basic credentials, or custom authentication headers. Redirect-time header stripping does not prevent the leak because the cross-host PUT is a new explicit request rather than a followed redirect. This is a residual of CVE-2026-59891, whose fix changed credential selection in credentials.ts but did not constrain where credentials are sent from registry.ts. Version 0.7.2 fixes the issue by separating registry credentials from client-wide defaults and sending them only to the registry origin.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_