{"id":"CVE-2026-77564","kind":"vulnerability","aliases":["CVE-2026-77564","GHSA-7cxh-94cf-mfp6"],"related":[],"title":"Talos Linux: Support bundle does not redact registry credentials","description":"### Summary\nWhen generating a support bundle with `talosctl support` the credentials entered for private registries are included in the bundle.\n\n\n### Details\n\nWithin the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.\nThe same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.\n\n### PoC\n\nSimply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource \n\n### Impact\n\nThe problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.\n\nIn most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly.\n\n\n### Notes\n\nTalos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower.\n\n### Environment\n\n- Talos version: v1.13.0\n- Kubernetes version: 1.35.3\n- Platform: amd64","summary":"The talosctl support command writes private registry auth settings into the generated support bundle without redacting them. Anyone who gets a bundle and has not been given it encrypted can read those registry credentials.","severity":"low","cvss":3.3,"epss":0.00131,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siderolabs/talos","fixed":["1.14.0-alpha.0.0.20260513110206-76080416beee"],"affected":"< 1.14.0-alpha.0.0.20260513110206-76080416beee","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-312","infrastructure","kubernetes","registry","self-hosted","talos"],"not_affected_if":["encrypted-support-bundles","managed-hosting","no-registry-auth-config"],"how_to_check":"- Run `talosctl version` and compare against the fixed build listed in the advisory.\n- Check whether the cluster has a `RegistryAuthConfig` resource, which the advisory says triggers the leak.\n- Unpack a generated support bundle and look for `auth` fields in `resources/registryconfigs.cri.talos.dev.yaml` and `etcfilespecs.files.talos.dev.yaml`.","fix":"- Upgrade Talos to a build at or after `1.14.0-alpha.0.0.20260513110206-76080416beee` (the fixed Go module version).\n- Rotate any private registry credentials that were included in bundles already shared outside the team.\n- Until upgraded, do not share support bundles publicly.","status":"open","published_at":"2026-10-14T17:19:11+00:00","first_seen_at":"2026-10-26T14:42:05+00:00","triaged_at":"2026-10-26T14:42:24+00:00","updated_at":"2026-10-26T15:00:59+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-26T14:42:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Talos to a build at or after `1.14.0-alpha.0.0.20260513110206-76080416beee` (the fixed Go module version).\n- Rotate any private registry credentials that were included in bundles already shared outside the team.\n- Until upgraded, do not share support bundles publicly.","reach":"local","title":"Talos Linux: support bundle leaks private registry credentials in plain text","impact":"medium","summary":"The talosctl support command writes private registry auth settings into the generated support bundle without redacting them. Anyone who gets a bundle and has not been given it encrypted can read those registry credentials.","category":"infrastructure","nicknames":[],"who_cares":["talos","kubernetes","self-hosted","registry"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Private registry credentials leak; write access could allow tag hijacking","analyst_note":"","how_to_check":"- Run `talosctl version` and compare against the fixed build listed in the advisory.\n- Check whether the cluster has a `RegistryAuthConfig` resource, which the advisory says triggers the leak.\n- Unpack a generated support bundle and look for `auth` fields in `resources/registryconfigs.cri.talos.dev.yaml` and `etcfilespecs.files.talos.dev.yaml`.","needs_analyst":false,"not_affected_if":["encrypted-support-bundles","no-registry-auth-config","managed-hosting"],"who_is_affected":"Teams running Talos Linux clusters that configure private registry credentials through a `RegistryAuthConfig` resource. The exposure is only when a support bundle is created and then shared with someone outside the trust boundary. Talos 1.14 and later encrypt support bundles to age recipients by default, which lowers the risk.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000709,"input_tokens":3801,"output_tokens":657,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,19A '-312':25B '-77564':12A,20A '/siderolabs/talos':23A '1.14':248C '1.35.3':278C '7cxh':15A '94cf':16A 'access':188C,195C 'affect':184C,224C 'age':257C 'amd64':280C 'anyon':50B,132C 'auth':40B,96C 'authent':155C 'bundl':4A,46B,54B,72C,86C,92C,139C,234C,254C 'chain':220C 'cluster':120C 'command':36B 'compromis':221C 'consequ':204C 'correct':171C 'could':149C,199C 'credenti':9A,66B,77C,168C,192C 'cve':10A,18A 'cwe':24B 'data':210C 'default':250C,260C 'denial':206C 'detail':87C 'encrypt':61B,251C 'enter':78C 'environ':272C 'etcfilespecs.files.talos.dev.yaml':111C 'even':270C 'ever':135C 'exist':214C 'field':97C 'forum':148C 'generat':44B,69C,90C 'get':52B 'ghsa':14A 'ghsa-7cxh-94cf-mfp6':13A 'github':142C,263C 'github.com':22A 'github.com/siderolabs/talos':21A 'given':59B 'hand':181C 'hijack':216C 'host':31B 'howev':131C 'impact':125C,268C 'impress':230C 'includ':83C 'inform':107C,239C 'infrastructur':26B 'insid':93C 'intern':154C 'issu':143C 'kubernet':27B,276C 'lead':200C,217C 'leak':152C 'linux':2A 'loss':211C 'lower':271C 'member':265C 'mfp6':17A 'minor':130C 'n':116C 'network':166C 'note':246C 'org':264C 'paramet':156C 'parti':225C 'platform':279C 'poc':112C 'possibl':202C,213C 'potenti':105C,151C 'present':109C 'privat':38B,80C,159C 'problem':127C,177C 'provid':191C 'public':147C,187C,245C 'read':63B 'recipi':258C 'redact':7A,48B,236C 'registri':8A,28B,39B,65B,81C,160C,185C 'registryauthconfig':123C 'resourc':124C 'resources/registryconfigs.cri.talos.dev.yaml':94C 'retain':102C 'run':114C 'self':30B 'self-host':29B 'sensit':106C,238C 'serious':203C 'servic':208C 'set':41B,170C 'share':244C 'siderolab':262C 'simpli':113C 'situat':163C 'slack':144C 'spec':100C 'specifi':259C 'summari':67C 'suppli':219C 'support':3A,35B,45B,71C,75C,91C,117C,233C,253C 'support.zip':138C 'tag':215C 'talo':1A,32B,247C,273C 'talosctl':34B,74C,115C 'thread':145C 'thus':241C 'upload':136C 'v1.13.0':275C 'version':274C,277C 'within':88C,110C 'without':47B 'write':37B,194C","nicknames":[],"mitigations":[],"who_affected":"Teams running Talos Linux clusters that configure private registry credentials through a `RegistryAuthConfig` resource. The exposure is only when a support bundle is created and then shared with someone outside the trust boundary. Talos 1.14 and later encrypt support bundles to age recipients by default, which lowers the risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-14T17:19:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7cxh-94cf-mfp6","url":"https://github.com/advisories/GHSA-7cxh-94cf-mfp6","severity":"low","published_at":"2026-10-15T20:20:16+00:00","modified_at":"2026-10-26T14:41:05+00:00","first_seen_at":"2026-10-26T14:42:05+00:00","fetched_at":"2026-10-26T14:47:19+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77564","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77564","severity":null,"published_at":"2026-10-14T17:19:11+00:00","modified_at":"2026-10-16T16:00:33+00:00","first_seen_at":"2026-10-26T15:00:59+00:00","fetched_at":"2026-10-26T15:00:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}