Skip to content
OpenAdvisories

Vendor

sigstore

40 known vulnerabilities.

Products

cosign 9 sigstore-js 5 rekor 5 gitsign 4 timestamp-authority 3 sigstore-java 3 sigstore-go 3 fulcio 3 sigstore-python 2 policy-controller 1 sigstore 1 sigstore-ruby 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.6
    CVE-2026-59891 Public exploit

    Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry

    sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target regis…

    sigstore sigstore-js @sigstore/oci npm