External risk intelligence

sigstore-js Incorrect Registry Credential Matching Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-59891

The vulnerability exists within a JavaScript library used for local development and build-time tasks, such as interacting with Sigstore services and reading local Docker configuration files. It is not a network-accessible service or web-facing application, but rather a developer-side utility used in build pipelines or local environments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in a JavaScript library used for Sigstore, a service that helps secure software. The issue involves how the library handles authentication credentials, potentially exposing them to unintended destinations due to a substring matching error. While the direct impact is localized to specific development or build environments, understanding its potential relevance is important for confirming exposure.

Credentials could be misdirected to wrong registries.
It impacts software signing and verification processes.
Confirm if your build environments are affected.

Attack Path

How an attacker could exploit the issue

An attacker could trick a user into running a malicious application that leverages the `sigstore-js` library. When the application attempts to authenticate with a specific registry, the library incorrectly matches credentials due to a substring flaw, potentially sending them to an unintended registry and leading to the exposure of sensitive information and unauthorized actions.

No authentication required.
Malicious code triggers incorrect credential matching.
Sensitive credentials may be exposed.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, credentials configured for one registry could be mistakenly sent to another registry due to a substring match in hostname identification. This may lead to unauthorized access or disclosure of sensitive information related to container image registries.

Registry credentials could be exposed.
Incorrect registry hostname match.
Unauthorized access to container registries.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determining the precise ownership for this vulnerability requires understanding how the `sigstore-js` library is integrated into your development and deployment pipelines. Application owners or platform teams are typically responsible for managing libraries used in their projects. The first practical step is to identify all systems and development environments where this library is present, assess its reachability, and confirm its criticality to business operations.

Application or platform teams own the issue.
Verify library usage and reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is sigstore-js?

sigstore-js is a JavaScript library that enables developers to interact with Sigstore services. It is primarily used during software development and automated build processes to facilitate the signing and verification of container images, helping ensure software integrity by managing how code connects to registry services.

What does CWE-522 mean for CVE-2026-59891?

This vulnerability relates to CWE-522, which involves the insufficient protection of credentials. In this specific case, the library uses an insecure method to identify which login information to use. Instead of checking for an exact match for a registry hostname, it accepts any matching substring, which can cause the software to accidentally use credentials intended for one system on a completely different, unauthorized one.

How can this credential mismatch be triggered?

The issue is triggered when the library attempts to authenticate with a registry using a stored Docker configuration. It does not occur through standard network requests alone; rather, an attacker would need to influence the environment where the library operates, such as tricking a user or a build system into processing a registry request that maps incorrectly due to the flawed matching logic.

Is my system at risk for this CVE-2026-59891 flaw?

According to Halo Surface Signal, this is very unlikely to be an internet-facing threat. Because sigstore-js is typically used as a developer utility in local environments or internal build pipelines, it is not a public-facing network service. You should primarily check systems where automated builds or local container workflows are managed.

What should I do to secure my build environments?

First, conduct an audit of your development and CI/CD pipelines to confirm if you are utilizing an affected version of the sigstore-js library. If detected, prioritize updating the library to version 0.7.1 or later. Platform and application teams should coordinate to verify where this tool is integrated to ensure the fix is applied across all relevant build infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.