{"cve":"CVE-2026-59891","nvd":{"published":"2026-07-14T17:17:15.270","modified":"2026-10-24T21:10:00.130","status":"Awaiting Analysis","description":"sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-522"],"references":["https://github.com/sigstore/sigstore-js/commit/85c58380758b97ce1b74ef470e55cc21f9d3aa89","https://github.com/sigstore/sigstore-js/releases/tag/%40sigstore%2Foci%400.7.1","https://github.com/sigstore/sigstore-js/security/advisories/GHSA-pf56-329r-95rw"],"products":[],"source":"nvd","synced_at":"2026-10-25T17:50:06.907763985+00:00"},"epss":{"cve":"CVE-2026-59891","score":0.00473,"percentile":0.40653,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-pf56-329r-95rw","url":"https://osv.dev/vulnerability/GHSA-pf56-329r-95rw","summary":"Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry","modified":"2026-07-21T19:45:24.990901157Z","packages":[{"ecosystem":"npm","name":"@sigstore/oci","purl":"pkg:npm/%40sigstore/oci","ranges":["<0.7.1"],"fixed":["0.7.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}