Executive brief
A vulnerability in the Sigstore OCI library can cause sensitive login credentials for software registries (like Docker Hub or GitHub Container Registry) to be sent to the wrong destination. If an attacker can influence where a software artifact is being uploaded, they could trick the system into sending your private access tokens to a server they control. This could lead to the theft of long-lived credentials and unauthorized access to your private software repositories.
Technical details
The `getRegistryCredentials()` function in `@sigstore/oci` incorrectly uses a substring match (`.includes()`) instead of an exact host match when retrieving credentials from the Docker configuration file (`~/.docker/config.json`). An attacker who can influence the destination registry or image reference (e.g., via the `subject-name` input in GitHub Actions) can provide a hostname that is a substring of a legitimate configured registry (e.g., `cr.io` matching `ghcr.io`). This causes the library to select and transmit the legitimate registry's credentials to the attacker-controlled server. The vulnerability is fixed in version 0.7.1 by implementing exact host matching and canonicalization.
Affected products
- Sigstore @sigstore/oci >= 0.1.0, < 0.7.1
Timeline
- 2026-07-08: patched: Fix released in version 0.7.1
- 2026-07-14: advisory: NVD published CVE-2026-59891
- 2026-07-21: disclosed: GitHub Advisory published