Skip to content
Threat Feed
Subscribe

Tag

Oci

1 brief RSS
high advisory

Sigstore-js: Registry credential disclosure (CVE-2026-118763)

The sigstore-js library prior to 0.7.2 fails to validate OCI registry redirect origins in RegistryClient.uploadBlob(), allowing compromised registries to perform unauthorized exfiltration of authentication headers to attacker-controlled hosts.

sigstore-js credential-theft oci supply-chain-security
1t 2c