sigstore-js: registry-supplied upload Location receives registry credentials, leaking tokens to an attacker host

Impact

In @sigstore/oci before 0.7.2, signIn() puts the registry Authorization and Docker config headers on a shared HTTP client's defaults, while uploadBlob() PUTs to whatever absolute blob-upload Location the registry returns without checking the origin or scheme. A malicious or compromised registry can point a push through attachArtifactToImage() at a host it controls and collect the bearer token, Basic credentials, or custom auth headers. For an operator this is a CI/CD supply-chain credential leak: the stolen token is the one your signing pipeline uses to write to the registry that feeds GPU node images. Redirect-time header stripping does not help, because the cross-host PUT is a new explicit request. The record notes this is a residual of CVE-2026-59891, whose fix touched credential selection but not the destination check.

Who can reach it

Requires the victim to push an artifact through sigstore-js to a registry the attacker controls or has compromised - typically a CI job or a developer running the signing step. Credentials are leaked at push time; no authentication to the attacker host is needed.

What to do

Upgrade @sigstore/oci to 0.7.2, which separates registry credentials from client-wide defaults and sends them only to the registry origin, then re-run affected pipelines. Rotate any registry token that was used to push to an untrusted registry while on a vulnerable version. This is a dependency bump plus a CI restart, no node maintenance.

References

Related entries

• BentoML (bentofile.yaml path fields: description, docker.setup_script, docker.dockerfile_templateCVE-2026-24123 · BentoMLHigh
• OpenShift Console: tenant-planted Helm repository makes the console pod fetch arbitrary URLs server-sideCVE-2026-50237 · Red Hat OpenShift Console (Helm catalog proxy, ProjectHelmChartRepository)High
• Envoy Gateway: unauthenticated xDS on port 18000 hands out TLS private keys and full routing configCVE-2026-53714 · Envoy Gateway xDS gRPC server in GatewayNamespaceMode (port 18000)High
• Envoy: stored XSS through unescaped dynamic statistic names on the admin stats pageCVE-2026-73546 · Envoy (admin /stats?format=html StatsHtmlRender)High
• openshift-ansible installer: unverified remote inventory scripts execute with cluster-provisioning privilegesCVE-2026-92092 · openshift-ansible installer container (run script fetches inventory/dynamic scripts over HTTP without verification)High
• Istio: Authentication Policy exact-path matching allows unauthorized access to HTTP pathsCVE-2020-8595 · IstioHigh