CVE-2026-118763: Cross-Origin Credential Exposure in @sigstore/oci

Vulnerability ID: CVE-2026-118763
CVSS Score: 7.4
Published: 2026-10-30

A credential exposure vulnerability exists in the @sigstore/oci library prior to version 0.7.2. The RegistryClient implementation stores sensitive authentication headers, including Bearer tokens, Basic authentication credentials, and custom Docker configuration headers, as client-wide defaults on its shared HTTP client instance. When uploading binary blobs via the OCI distribution specification, the client extracts the target upload URI from the server-supplied Location header and dispatches an independent HTTP PUT request. If a compromised or untrusted registry returns a cross-origin URI in the Location header, the client transmits the stored authentication credentials directly to the third-party host.

TL;DR

Versions of @sigstore/oci prior to 0.7.2 attach registry authentication headers as global defaults on the underlying HTTP client. During blob uploads, if an OCI registry responds with a cross-origin Location header, the client executes a new PUT request to the external URI and exposes registry credentials to the remote host.

Technical Details

• Vulnerability ID: CVE-2026-118763 / GHSA-j63v-mwhm-56jx
• Weakness Class: CWE-522 (Insufficiently Protected Credentials)
• Affected Package: @sigstore/oci (< 0.7.2)
• CVSS v3.1 Score: 7.4 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
• EPSS Score: 0.30% (22.72nd percentile)
• Impact: Cross-origin exposure of Basic/Bearer registry credentials
• Exploit Status: None (No known public exploits)
• CISA KEV Status: Not Listed

Affected Systems

• @sigstore/oci
• @sigstore/cli
• sigstore-js
• @sigstore/oci: < 0.7.2 (Fixed in: 0.7.2)

Code Analysis

Commit: b855f46

Separated credentials from the HTTP client instance and added strict origin scoping for headers.

Commit: e4ca65c

Introduced comprehensive network destination policies (network.ts), blocking non-public destinations and enforcing HTTPS.

Mitigation Strategies

• Upgrade @sigstore/oci to version 0.7.2 or later to enforce strict origin scoping on authentication headers.
• Upgrade @sigstore/cli to the latest release containing @sigstore/[email protected].
• Configure short-lived, repository-scoped OIDC or Bearer tokens in CI/CD pipelines rather than long-lived static Basic authentication credentials.
• Explicitly configure allowedPrivateOrigins or --allow-private-origin only for verified internal registry endpoints.

Remediation Steps:

1. Audit package.json and package-lock.json files across projects and CI/CD images to identify dependencies on @sigstore/oci < 0.7.2.
2. Run 'npm install @sigstore/oci@latest' or 'npm update @sigstore/cli' to pull the patched release.
3. If using internal or localhost registries in automated workflows, update CLI commands to include '--allow-private-origin ' or pass 'fetchOpts.allowedPrivateOrigins' in API calls.
4. Rotate any static registry credentials that were used to push artifacts to untrusted or third-party OCI registries.

References

• GitHub Security Advisory: GHSA-j63v-mwhm-56jx
• CVE.org Record: CVE-2026-118763
• NVD Vulnerability Detail: CVE-2026-118763
• sigstore-js Pull Request #1762
• Patch Commit 1: Exact Host Matching & Header Scoping
• Patch Commit 2: OCI Network Policy Hardening
• Release @sigstore/[email protected]
• CISA Known Exploited Vulnerabilities Catalog

Read the full report for CVE-2026-118763 on our website for more details including interactive diagrams and full exploit analysis.