{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/actions/attest-sbom/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-59891"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@sigstore/oci \u003c 0.7.1","actions/attest","actions/attest-build-provenance","actions/attest-sbom"],"_cs_severities":["critical"],"_cs_tags":["credential-exposure","vulnerability","github-actions","docker","supply-chain"],"_cs_type":"advisory","_cs_vendors":["Sigstore","GitHub"],"content_html":"\u003cp\u003eA critical credential exposure vulnerability, tracked as CVE-2026-59891, has been identified in \u003ccode\u003e@sigstore/oci\u003c/code\u003e versions \u003ccode\u003e\u0026lt;= 0.7.0\u003c/code\u003e. This flaw resides within the \u003ccode\u003egetRegistryCredentials()\u003c/code\u003e function, which is responsible for retrieving OCI registry authentication tokens from the Docker configuration file (\u003ccode\u003e~/.docker/config.json\u003c/code\u003e). The vulnerability stems from an insecure credential selection mechanism that uses a substring match instead of a precise host match. This means that credentials configured for a legitimate registry (e.g., \u003ccode\u003eghcr.io\u003c/code\u003e) could be mistakenly associated with, and subsequently transmitted to, an attacker-controlled registry if its hostname is a substring of the legitimate one (e.g., \u003ccode\u003ecr.io\u003c/code\u003e). This impacts any application using \u003ccode\u003e@sigstore/oci\u003c/code\u003e to upload artifacts, including \u003ccode\u003e@actions/attest\u003c/code\u003e and the \u003ccode\u003eactions/attest\u003c/code\u003e, \u003ccode\u003eactions/attest-build-provenance\u003c/code\u003e, and \u003ccode\u003eactions/attest-sbom\u003c/code\u003e GitHub Actions, particularly when the destination registry or image reference (\u003ccode\u003esubject-name\u003c/code\u003e input) can be influenced by untrusted sources. This could lead to the leakage of long-lived registry tokens to malicious actors. The vulnerability was patched in \u003ccode\u003e@sigstore/oci@0.7.1\u003c/code\u003e, which implements exact host matching.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a target system utilizing \u003ccode\u003e@sigstore/oci\u003c/code\u003e (or GitHub Actions like \u003ccode\u003eactions/attest\u003c/code\u003e) for pushing artifacts to OCI registries.\u003c/li\u003e\n\u003cli\u003eThe attacker researches or infers that the target system has configured credentials for a legitimate OCI registry (e.g., \u003ccode\u003eghcr.io\u003c/code\u003e) stored in its \u003ccode\u003e~/.docker/config.json\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker registers or gains control over a malicious OCI registry with a hostname that is a substring of the legitimate registry's hostname (e.g., \u003ccode\u003ecr.io\u003c/code\u003e for \u003ccode\u003eghcr.io\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker influences the target system to push artifacts to the attacker-controlled registry by manipulating the destination registry or image reference. In the context of GitHub Actions, this might involve influencing the \u003ccode\u003esubject-name\u003c/code\u003e input when \u003ccode\u003epush-to-registry: true\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDuring the artifact push operation, the \u003ccode\u003e@sigstore/oci\u003c/code\u003e library calls \u003ccode\u003egetRegistryCredentials()\u003c/code\u003e to retrieve authentication.\u003c/li\u003e\n\u003cli\u003eDue to the substring matching logic, \u003ccode\u003egetRegistryCredentials()\u003c/code\u003e incorrectly selects the credentials intended for \u003ccode\u003eghcr.io\u003c/code\u003e (because \u003ccode\u003ecr.io\u003c/code\u003e is a substring).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e@sigstore/oci\u003c/code\u003e library then transmits these long-lived registry credentials to the attacker-controlled registry (\u003ccode\u003ecr.io\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker captures the stolen registry credentials, gaining unauthorized access to the legitimate registry.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact of CVE-2026-59891 is the potential exposure of sensitive, long-lived OCI registry credentials. Any consumer of \u003ccode\u003e@sigstore/oci\u003c/code\u003e or related GitHub Actions (such as \u003ccode\u003eactions/attest\u003c/code\u003e, \u003ccode\u003eactions/attest-build-provenance\u003c/code\u003e, and \u003ccode\u003eactions/attest-sbom\u003c/code\u003e) that pushes artifacts using credentials from a Docker configuration file is susceptible. While no specific victim count is provided, the theoretical worst-case scenario involves the theft of valuable authentication tokens, granting attackers unauthorized access to artifact repositories, enabling supply chain attacks, or facilitating further lateral movement. Exploitation requires specific conditions: credentials in the Docker config, untrusted influence over the destination registry, and an attacker-controlled registry with a substring hostname.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-59891 immediately\u003c/strong\u003e: Upgrade \u003ccode\u003e@sigstore/oci\u003c/code\u003e to version \u003ccode\u003e0.7.1\u003c/code\u003e or later to fix the credential selection logic.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUpdate GitHub Actions\u003c/strong\u003e: Ensure that your GitHub Actions workflows using \u003ccode\u003eactions/attest\u003c/code\u003e, \u003ccode\u003eactions/attest-build-provenance\u003c/code\u003e, or \u003ccode\u003eactions/attest-sbom\u003c/code\u003e are updated to versions that bundle the patched \u003ccode\u003e@sigstore/oci\u003c/code\u003e library.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eValidate input\u003c/strong\u003e: Treat the destination registry/image reference as trusted input; do not allow untrusted sources to influence the registry/image reference passed to \u003ccode\u003e@sigstore/oci\u003c/code\u003e or the \u003ccode\u003esubject-name\u003c/code\u003e of \u003ccode\u003eactions/attest*\u003c/code\u003e when \u003ccode\u003epush-to-registry: true\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eLimit \u003ccode\u003e~/.docker/config.json\u003c/code\u003e credentials\u003c/strong\u003e: Restrict the credentials available in the host's Docker config file (\u003ccode\u003e~/.docker/config.json\u003c/code\u003e) to only those strictly necessary for operations, and avoid authenticating to registries whose hostnames could have substring relationships with potential untrusted destinations.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eScope tokens narrowly\u003c/strong\u003e: Prefer using narrowly scoped and short-lived registry tokens to minimize the impact of potential credential leakage.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T19:35:10Z","date_published":"2026-07-21T19:35:10Z","id":"https://feed.craftedsignal.io/briefs/2026-07-sigstore-oci-credential-confusion/","summary":"A critical credential exposure vulnerability (CVE-2026-59891) exists in `@sigstore/oci` versions prior to 0.7.1. The `getRegistryCredentials()` function, used to read credentials from `~/.docker/config.json`, employs a substring match instead of an exact host match when selecting credentials. This flaw allows credentials for a legitimate registry (e.g., `ghcr.io`) to be inadvertently transmitted to an attacker-controlled registry if its hostname is a substring of the legitimate one (e.g., `cr.io`). This impacts consumers of `@sigstore/oci` and related GitHub Actions (`actions/attest`, `actions/attest-build-provenance`, `actions/attest-sbom`) when pushing artifacts to untrusted or attacker-influenced destination registries, potentially leading to the leakage of long-lived registry tokens. The vulnerability is fixed in `@sigstore/oci@0.7.1` by enforcing exact host matching.","title":"Sigstore/OCI Credential Confusion Vulnerability (CVE-2026-59891)","url":"https://feed.craftedsignal.io/briefs/2026-07-sigstore-oci-credential-confusion/"}],"language":"en","title":"CraftedSignal Threat Feed - Actions/Attest-Sbom","version":"https://jsonfeed.org/version/1.1"}