sigstore-js: substring registry match sends Docker config credentials to the wrong registry

Impact

sigstore-js is the JavaScript implementation used to sign and attest container images, so it runs in the image-build and admission pipelines that feed a GPU fleet. Before 0.7.1, getRegistryCredentials() picks an entry from the Docker config file by checking whether any configured auth key merely contains the target registry string, instead of matching the host exactly. A registry hostname that is a substring relative of a configured key therefore receives credentials meant for a different registry. For an operator that means a push or attestation aimed at an attacker-chosen or typo'd registry can hand over the token for the internal registry that holds the fleet's CUDA, inference and training images - and write access to that registry is write access to what every GPU node pulls.

Who can reach it

Someone who can influence the registry reference that a signing or attestation step operates on - a pull request, a build parameter, or a workflow input in CI - and who controls a registry host whose name has a substring relationship with a configured auth key. No access to the CI host itself is needed; the CVSS vector records required user interaction.

What to do

Upgrade @sigstore/oci to 0.7.1 (commit 85c5838) in the build images and lockfiles of every pipeline that signs or attests images, then rebuild the CI images - no node-level maintenance is involved. Treat credentials in any Docker config that a vulnerable version read as potentially disclosed and rotate the registry tokens, and audit registry logs for pushes to unexpected hosts.

References

Related entries

• RHACM GitOpsCluster: tenant can redirect spoke cluster bearer tokens into a namespace they controlCVE-2026-70398 · Red Hat Advanced Cluster Management - multicloud-integrations (GitOpsCluster controller)Critical
• Dokploy: unquoted dockerImage field gives command execution on the build hostCVE-2026-72877 · Dokploy Docker build path (dockerImage field in buildRemoteDocker)Critical
• OpenChoreo cluster-gateway: unauthenticated management API exposes data-plane Kubernetes API and pod execCVE-2026-73843 · OpenChoreo cluster-gateway (agent listener management API)Critical
• Rancher: SAML assertion replay: the ACS handler does not enforce one-time use, so a captured assertion logsCVE-2026-44946 · RancherCritical
• Coolify: low-privileged member injects Docker Compose directives and gets root on the hostCVE-2025-59156 · Coolify (application deployment workflow, Docker Compose directives)Critical
• Kyverno: percent-encoded traversal in Policy apiCall urlPath escapes the namespace clamp to cluster adminCVE-2026-100706 · Kyverno admission controller (Policy apiCall urlPath namespace clamp)Critical