CVE-2026-59891: CWE-522: Insufficiently Protected Credentials in sigstore sigstore-js
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.
AI Analysis
Technical Summary
The vulnerability in sigstore-js (CVE-2026-59891) arises from the getRegistryCredentials() function reading Docker config credentials and selecting them based on substring matches of registry hostnames rather than exact matches. This insufficient protection of credentials (CWE-522) can lead to credentials configured for one registry being transmitted to a different registry with a hostname that contains the configured auth key as a substring. This flaw affects versions prior to 0.7.1 and is resolved in version 0.7.1.
Potential Impact
An attacker controlling or impersonating a registry with a hostname that is a substring of a configured registry could receive credentials not intended for it, potentially leading to credential disclosure and unauthorized access. The CVSS score of 9.6 reflects critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade sigstore-js to version 0.7.1 or later, where the substring matching issue in getRegistryCredentials() has been fixed. No other mitigation or temporary workaround is indicated.
CVE-2026-59891: CWE-522: Insufficiently Protected Credentials in sigstore sigstore-js
Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring match rather than an exact host match, credentials configured for one registry can be selected for and transmitted to a different registry whose hostname has a substring relationship with a configured auth key. This issue is fixed in version 0.7.1.
CVSS v3.1
Score 9.6critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in sigstore-js (CVE-2026-59891) arises from the getRegistryCredentials() function reading Docker config credentials and selecting them based on substring matches of registry hostnames rather than exact matches. This insufficient protection of credentials (CWE-522) can lead to credentials configured for one registry being transmitted to a different registry with a hostname that contains the configured auth key as a substring. This flaw affects versions prior to 0.7.1 and is resolved in version 0.7.1.
Potential Impact
An attacker controlling or impersonating a registry with a hostname that is a substring of a configured registry could receive credentials not intended for it, potentially leading to credential disclosure and unauthorized access. The CVSS score of 9.6 reflects critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade sigstore-js to version 0.7.1 or later, where the substring matching issue in getRegistryCredentials() has been fixed. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-07T16:40:07.983Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a566f8668715ace43e6c13b
Added to database: 07/14/2026, 17:19:02 UTC
Last enriched: 07/21/2026, 20:08:34 UTC
Last updated: 08/26/2026, 22:52:11 UTC
Views: 108
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.