CVE-2026-59891
sigstore-js is a JavaScript library that helps developers interact with Sigstore services. In versions before 0.7.1, the library incorrectly matched registry credentials by substring, which could cause credentials for one registry to be sent to another. This flaw allows an attacker to obtain and misuse private registry credentials.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
sigstore-js library, any project using it with a version earlier than 0.7.1. Developers or CI/CD pipelines that rely on this library to pull or push container images.
Real-world impact
An attacker who can influence the registry selection could capture the credentials stored in the Docker config file and use them to access private images, push malicious images, or otherwise compromise the registry’s security.
Why this severity
The CVSS score of 9.6 reflects a network‑based attack that requires no special privileges and only a user interface to trigger. Because the flaw can expose all confidentiality, integrity, and availability of the registry, the impact is rated high for all three metrics.
What to do about it
- 01Upgrade sigstore-js to version 0.7.1 or later.
NVD-referenced vendor advisory
Timeline
- Jul 14, 2026 · 20d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 13d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.