CVE-2026-118763: Cross-Origin Credential Exposure in @sigstore/oci

Vulnerability ID: CVE-2026-118763
CVSS Score: 7.4
Published: 2026-10-30

A credential exposure vulnerability exists in the @sigstore/oci library prior to version 0.7.2. The RegistryClient implementation stores sensitive authentication headers, including Bearer tokens, Basic authentication credentials, and custom Docker configuration headers, as client-wide defaults on its shared HTTP client instance. When uploading binary blobs via the OCI distribution specification, the client extracts the target upload URI from the server-supplied Location header and dispatches an independent HTTP PUT request. If a compromised or untrusted registry returns a cross-origin URI in the Location header, the client transmits the stored authentication credentials directly to the third-party host.

TL;DR

Versions of @sigstore/oci prior to 0.7.2 attach registry authentication headers as global defaults on the underlying HTTP client. During blob uploads, if an OCI registry responds with a cross-origin Location header, the client executes a new PUT request to the external URI and exposes registry credentials to the remote host.

Technical Details

Vulnerability ID: CVE-2026-118763 / GHSA-j63v-mwhm-56jx
Weakness Class: CWE-522 (Insufficiently Protected Credentials)
Affected Package: @sigstore/oci (< 0.7.2)
CVSS v3.1 Score: 7.4 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N)
EPSS Score: 0.30% (22.72nd percentile)
Impact: Cross-origin exposure of Basic/Bearer registry credentials
Exploit Status: None (No known public exploits)
CISA KEV Status: Not Listed

Affected Systems

@sigstore/oci
@sigstore/cli
sigstore-js
@sigstore/oci: < 0.7.2 (Fixed in: 0.7.2)

Code Analysis

Commit: b855f46

Separated credentials from the HTTP client instance and added strict origin scoping for headers.

Commit: e4ca65c

Introduced comprehensive network destination policies (network.ts), blocking non-public destinations and enforcing HTTPS.

Mitigation Strategies

Upgrade @sigstore/oci to version 0.7.2 or later to enforce strict origin scoping on authentication headers.
Upgrade @sigstore/cli to the latest release containing @sigstore/oci@0.7.2.
Configure short-lived, repository-scoped OIDC or Bearer tokens in CI/CD pipelines rather than long-lived static Basic authentication credentials.
Explicitly configure allowedPrivateOrigins or --allow-private-origin only for verified internal registry endpoints.

Remediation Steps:

Audit package.json and package-lock.json files across projects and CI/CD images to identify dependencies on @sigstore/oci < 0.7.2.
Run 'npm install @sigstore/oci@latest' or 'npm update @sigstore/cli' to pull the patched release.
If using internal or localhost registries in automated workflows, update CLI commands to include '--allow-private-origin ' or pass 'fetchOpts.allowedPrivateOrigins' in API calls.
Rotate any static registry credentials that were used to push artifacts to untrusted or third-party OCI registries.