sigstore

CVE-2026-118763: CVE-2026-118763: Cross-Origin Credential Exposure in @sigstore/oci CVE-2026-118763: Cross-Origin Credential Exposure in @sigstore/oci > Vulnerability ID: CVE-2026-118763 > CVSS Score: 7.4 > Published: 2026-10-30 A credential exposure vulnerability exists in the @sigstore/oci library prior to version 0.7.2. The RegistryClient implementation stores sensitive authentication headers, including Bearer tokens, Basic authentication credentials, and custom Docker configuration headers, as client-wide defaults on its shared HTTP client instance. When uploading binary blobs via the OCI distribution specification, the client extracts the target upload URI from the server-supplied Location header and dispatches an independent HTTP PUT request. If a compromised or untrusted registry returns a cross-origin URI in the Location header, the client transmits the stored authentication credentials directly to the third-party host. TL;DR Versions of @sigstore/oci prior to 0.7.2 attach registry authentication headers as global defaults on the underlying HTTP client. During blob uploads, if an OCI registry responds with a cross-origin Location header, the client executes a new PUT request to the external URI and exposes registry credentials to the remote host. --- Technical Details - Vulnerability ID: CVE-2026-118763 / GHSA-j63v-mwhm-56jx - Weakness Class: CWE-522 (Insufficiently Protected Credentials) - Affected Package: @sigstore/oci (< 0.7.2) - CVSS v3.1 Score: 7.4 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) - EPSS Score: 0.30% (22.72nd percentile) - Impact: Cross-origin exposure of Basic/Bearer registry credentials - Exploit Status: None (No known public exploits) - CISA KEV Status: Not Listed Affected Systems - @sigstore/oci - @sigstore/cli - sigstore-js - @sigstore/oci: < 0.7.2 (Fixed in: 0.7.2) Code Analysis Commit: b855f46 Separated credentials from the HTTP client instance and added strict origin scoping for headers. Commit: e4ca65c Introduced comprehensive network destination policies (network.ts), blocking non-public destinations and enforcing HTTPS. Mitigation Strategies - Upgrade @sigstore/oci to version 0.7.2 or later to enforce strict origin scoping on authentication headers. - Upgrade @sigstore/cli to the latest release containing @sigstore/oci@0.7.2. - Configure short-lived, repository-scoped OIDC or Bearer tokens in CI/CD pipelines rather than long-lived static Basic authentication credentials. - Explicitly configure allowedPrivateOrigins or --allow-private-origin only for verified internal registry endpoints. Remediation Steps: 1. Audit package.json and package-lock.json files across projects and CI/CD images to identify dependencies on @sigstore/oci < 0.7.2. 2. Run 'npm install @sigstore/oci@latest' or 'npm update @sigstore/cli' to pull the patched release. 3. If using internal or localhost registries in automated workflows, update CLI commands to include '--allow-private-origin <origin>' or pass 'fetchOpts.allowedPrivateOrigins' in API calls. 4. Rotate any static registry credentials that were used to push artifacts to untrusted or third-party OCI registries. References - GitHub Security Advisory: GHSA-j63v-mwhm-56jx - CVE.org Record: CVE-2026-118763 - NVD Vulnerability Detail: CVE-2026-118763 - sigstore-js Pull Request #1762 - Patch Commit 1: Exact Host Matching & Header Scoping - Patch Commit 2: OCI Network Policy Hardening - Release @sigstore/oci@0.7.2 - CISA Known Exploited Vulnerabilities Catalog --- Read the full report for CVE-2026-118763 on our website for more details including interactive diagrams and full exploit analysis.

Keyless image signing with cosign in GitHub Actions A long-lived signing key is one more secret to leak. With keyless signing, the job uses its GitHub OIDC token (permissions: id-token: write) to get a short-lived Sigstore certificate. Sign the image by digest, not tag. Then verify who signed it (your workflow's identity) and the issuer (token.actions.githubusercontent.com). Maps to OWASP CICD-SEC-9, Improper Artifact Integrity Validation. Job excerpt (fictional acme-lab, placeholder values, .github/workflows/release.yml): permissions: contents: read packages: write id-token: write steps: - uses: sigstore/cosign-installer@v4.1.2 # ...log in, build and push (id: build) - run: cosign sign --yes "$IMAGE@$DIGEST" env: IMAGE: ghcr.io/acme-lab/app DIGEST: ${{ steps.build.outputs.digest }} Verify before deploy: cosign verify \ --certificate-identity-regexp '^github\.com/acme-lab/app/\.github/workflows/' \ --certificate-oidc-issuer token.actions.githubusercontent.com \ ghcr.io/acme-lab/app@sha256:YOUR_DIGEST Notes: - To lock it to one workflow and branch, use --certificate-identity github.com/acme-lab/app/.github/workflows/release… - cosign-installer has no floating @v4 tag, so pin a full release (v4.1.2 is the latest as of 20 Oct 2026) or a commit SHA. It installs cosign v3.0.6 by default; set cosign-release to pin a newer cosign. - --yes skips cosign's confirmation prompt (Sigstore docs: it agrees to Sigstore's terms of use), which suits non-interactive CI. - Signing events are recorded in Sigstore's public Rekor transparency log, and the certificate identity includes the repo and workflow path. Bear that in mind for private repos. Sources: OWASP CICD-SEC-9: owasp.org Sigstore, keyless signing overview: docs.sigstore.dev Sigstore CI quickstart: docs.sigstore.dev Sigstore verification cheat sheet: docs.sigstore.dev sigstore/cosign-installer: sigstore/cosign-installer GitHub Docs, OIDC reference (id-token: write): docs.github.com Related: OWASP Top 10 CI/CD risks youtube.com Narration uses an AI-generated voice. Fictional acme-lab demo; defensive education only. #Shorts #GitHubActions #Sigstore #DevSecOps #SupplyChainSecurity