CVE-2026-77564: CWE-312: Cleartext Storage of Sensitive Information in siderolabs talos

Talos Linux versions before 1.12.9 and from 1.13.0 up to but not including 1.13.3 generate support bundles that include sensitive authentication data from resources/registryconfigs.cri.talos.dev.yaml and etcfilespecs.files.talos.dev.yaml in cleartext. This cleartext storage of sensitive information (CWE-312) risks exposing private registry credentials if support bundles are shared improperly. Starting with Talos 1.14, support bundles are encrypted by default, reducing exposure risk. The issue is fixed in versions 1.12.9 and 1.13.3.

The vulnerability allows disclosure of private registry authentication parameters if support bundles containing these cleartext credentials are shared with unintended parties. The impact depends on the network exposure of the registry and the privileges of the credentials. The CVSS score is 3.3 (low), indicating limited confidentiality impact with no integrity or availability effects.

Upgrade Talos Linux to version 1.12.9 or later, or 1.13.3 or later, where this issue is fixed. Versions 1.14 and later encrypt support bundles by default, further reducing risk. Operators should avoid sharing support bundles with unauthorized parties and ensure use of fixed or later versions to prevent sensitive data exposure.