Threats tagged 'ghsa-7cxh-94cf-mfp6'

CVE-2026-77564 is a low-severity vulnerability in siderolabs talos where credentials for private registries are stored in cleartext within generated support bundles. Specifically, the auth field in registry configuration files inside the support bundle retains sensitive authentication data. While the impact is generally minor due to default encryption in Talos 1.14+, earlier versions (notably 1.13.0 to before 1.13.3) do not encrypt these bundles by default, increasing risk if the bundle is shared publicly. Exposure of these credentials could lead to unauthorized registry access, potentially causing denial of service, data loss, or supply chain compromise if the registry is publicly accessible and credentials allow write access.