CVE-2026-59891: Sigstore sigstore-js credential leakage via registry substring match

CVE-2026-59891 · Severity: critical · CVSS 9.6 · Published 2026-07-14

A vulnerability in the Sigstore OCI library can cause sensitive login credentials for software registries (like Docker Hub or GitHub Container Registry) to be sent to the wrong destination. If an attacker can influence where a software artifact is being uploaded, they could trick the system into sending your private access tokens to a server they control. This could lead to the theft of long-lived credentials and unauthorized access to your private software repositories.

Technologies: Sigstore-Js. Vendors: npm, Sigstore.

Quick answers

Is CVE-2026-59891 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59891 being exploited in the wild.
How severe is CVE-2026-59891?
Critical severity, with a CVSS score of 9.6, published 14 July 2026.
Which products and versions are affected?
@sigstore/oci (npm) < 0.7.1, SEMVER:introduced=0,fixed=0.7.1; Sigstore Oci >= 0.1.0, < 0.7.1; Sigstore-Js < 0.7.1.
Is there a fix for CVE-2026-59891?
Yes. @sigstore/oci (npm): upgrade to 0.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59891 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59891?
Check whether you run @sigstore/oci (npm), Sigstore Oci or Sigstore-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @sigstore/oci (npm): upgrade to 0.7.1 or later
    npm install @sigstore/oci@0.7.1

Technical details

The `getRegistryCredentials()` function in `@sigstore/oci` incorrectly uses a substring match (`.includes()`) instead of an exact host match when retrieving credentials from the Docker configuration file (`~/.docker/config.json`). An attacker who can influence the destination registry or image reference (e.g., via the `subject-name` input in GitHub Actions) can provide a hostname that is a substring of a legitimate configured registry (e.g., `cr.io` matching `ghcr.io`). This causes the library to select and transmit the legitimate registry's credentials to the attacker-controlled server. The vulnerability is fixed in version 0.7.1 by implementing exact host matching and canonicalization.

Affected products

  • Sigstore @sigstore/oci >= 0.1.0, < 0.7.1

Identifiers

  • CVE-2026-59891
  • GHSA-pf56-329r-95rw

Timeline

  • 2026-07-08: patched: Fix released in version 0.7.1
  • 2026-07-14: advisory: NVD published CVE-2026-59891
  • 2026-07-21: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.