Vulnerability-Lookup

CVE-2026-77564 (GCVE-0-2026-77564)

Vulnerability from cvelistv5 – Published: 2026-10-14 16:09 – Updated: 2026-10-29 14:17

Title

Talos Linux: Support bundle does not redact registry credentials

Summary

Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.

Severity

3.3 (Low)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 14:17 UTC

CWE

CWE-312 - Cleartext Storage of Sensitive Information

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8044 records in the last 180 days details

References

9 references

URL	Tags
https://github.com/siderolabs/talos/security/advi…	x_refsource_CONFIRM
https://github.com/siderolabs/talos/pull/13345	x_refsource_MISC
https://github.com/siderolabs/talos/pull/13434	x_refsource_MISC
https://github.com/siderolabs/talos/pull/13611	x_refsource_MISC
https://github.com/siderolabs/talos/commit/4c288c…	x_refsource_MISC
https://github.com/siderolabs/talos/commit/760804…	x_refsource_MISC
https://github.com/siderolabs/talos/commit/7dc716…	x_refsource_MISC
https://github.com/siderolabs/talos/releases/tag/…	x_refsource_MISC
https://github.com/siderolabs/talos/releases/tag/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
siderolabs	talos	Affected: < 1.12.9 Affected: >= 1.13.0, < 1.13.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77564",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:17:28.247770Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T14:17:38.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "talos",
          "vendor": "siderolabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.12.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry\u0027s network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312: Cleartext Storage of Sensitive Information",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T16:09:11.330Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6"
        },
        {
          "name": "https://github.com/siderolabs/talos/pull/13345",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/talos/pull/13345"
        },
        {
          "name": "https://github.com/siderolabs/talos/pull/13434",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/talos/pull/13434"
        },
        {
          "name": "https://github.com/siderolabs/talos/pull/13611",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/talos/pull/13611"
        },
        {
          "name": "https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142"
        },
        {
          "name": "https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e"
        },
        {
          "name": "https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb"
        },
        {
          "name": "https://github.com/siderolabs/talos/releases/tag/v1.12.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/talos/releases/tag/v1.12.9"
        },
        {
          "name": "https://github.com/siderolabs/talos/releases/tag/v1.13.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/siderolabs/talos/releases/tag/v1.13.3"
        }
      ],
      "source": {
        "advisory": "GHSA-7cxh-94cf-mfp6",
        "discovery": "UNKNOWN"
      },
      "title": "Talos Linux: Support bundle does not redact registry credentials"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77564",
    "datePublished": "2026-10-14T16:09:11.330Z",
    "dateReserved": "2026-08-20T20:35:30.147Z",
    "dateUpdated": "2026-10-29T14:17:38.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77564",
      "date": "2026-10-30",
      "epss": "0.00131",
      "percentile": "0.02674"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "talos",
                "vendor": "siderolabs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.12.9"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 1.13.0, \u003c 1.13.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry\u0027s network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3."
          }
        ],
        "id": "CVE-2026-77564",
        "lastModified": "2026-10-29T15:17:24.197",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77564",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T14:17:28.247770Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-14T17:19:11.437",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/pull/13345"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/pull/13434"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/pull/13611"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/releases/tag/v1.12.9"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/releases/tag/v1.13.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-312"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77564",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-29T14:17:28.247770Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-29T14:17:33.390Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "talos",
              "vendor": "siderolabs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.12.9"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 1.13.0, \u003c 1.13.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry\u0027s network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 3.3,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-312",
                  "description": "CWE-312: Cleartext Storage of Sensitive Information",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-14T16:09:11.330Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6"
            },
            {
              "name": "https://github.com/siderolabs/talos/pull/13345",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siderolabs/talos/pull/13345"
            },
            {
              "name": "https://github.com/siderolabs/talos/pull/13434",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siderolabs/talos/pull/13434"
            },
            {
              "name": "https://github.com/siderolabs/talos/pull/13611",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siderolabs/talos/pull/13611"
            },
            {
              "name": "https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142"
            },
            {
              "name": "https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e"
            },
            {
              "name": "https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb"
            },
            {
              "name": "https://github.com/siderolabs/talos/releases/tag/v1.12.9",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siderolabs/talos/releases/tag/v1.12.9"
            },
            {
              "name": "https://github.com/siderolabs/talos/releases/tag/v1.13.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/siderolabs/talos/releases/tag/v1.13.3"
            }
          ],
          "source": {
            "advisory": "GHSA-7cxh-94cf-mfp6",
            "discovery": "UNKNOWN"
          },
          "title": "Talos Linux: Support bundle does not redact registry credentials"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-77564",
        "datePublished": "2026-10-14T16:09:11.330Z",
        "dateReserved": "2026-08-20T20:35:30.147Z",
        "dateUpdated": "2026-10-29T14:17:38.468Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-77564

Vulnerability from fkie_nvd - Published: 2026-10-14 17:19 - Updated: 2026-10-29 15:17

Severity

3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142
	security-advisories@github.com	https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e
	security-advisories@github.com	https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb
	security-advisories@github.com	https://github.com/siderolabs/talos/pull/13345
	security-advisories@github.com	https://github.com/siderolabs/talos/pull/13434
	security-advisories@github.com	https://github.com/siderolabs/talos/pull/13611
	security-advisories@github.com	https://github.com/siderolabs/talos/releases/tag/v1.12.9
	security-advisories@github.com	https://github.com/siderolabs/talos/releases/tag/v1.13.3
	security-advisories@github.com	https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "talos",
          "vendor": "siderolabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.12.9"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.13.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry\u0027s network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3."
    }
  ],
  "id": "CVE-2026-77564",
  "lastModified": "2026-10-29T15:17:24.197",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77564",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-29T14:17:28.247770Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-14T17:19:11.437",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/pull/13345"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/pull/13434"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/pull/13611"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/releases/tag/v1.12.9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/releases/tag/v1.13.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-312"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7CXH-94CF-MFP6

Vulnerability from github – Published: 2026-10-15 20:20 – Updated: 2026-10-26 14:41

Summary

Talos Linux: Support bundle does not redact registry credentials

Details

Summary

When generating a support bundle with talosctl support the credentials entered for private registries are included in the bundle.

Details

Within the generated support bundle, inside resources/registryconfigs.cri.talos.dev.yaml the auth field of the spec is retained. The same, potentially sensitive information is present within etcfilespecs.files.talos.dev.yaml.

PoC

Simply run talosctl -n [...] support on a cluster with a RegistryAuthConfig resource

Impact

The problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.

In most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly.

Notes

Talos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower.

Environment

Talos version: v1.13.0
Kubernetes version: 1.35.3
Platform: amd64

Severity

3.3 (Low)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siderolabs/talos"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.0-alpha.0.0.20260513110206-76080416beee"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77564"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-312"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:20:16Z",
    "nvd_published_at": "2026-10-14T17:19:11Z",
    "severity": "LOW"
  },
  "details": "### Summary\nWhen generating a support bundle with `talosctl support` the credentials entered for private registries are included in the bundle.\n\n\n### Details\n\nWithin the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.\nThe same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.\n\n### PoC\n\nSimply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource \n\n### Impact\n\nThe problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.\n\nIn most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly.\n\n\n### Notes\n\nTalos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower.\n\n### Environment\n\n- Talos version: v1.13.0\n- Kubernetes version: 1.35.3\n- Platform: amd64",
  "id": "GHSA-7cxh-94cf-mfp6",
  "modified": "2026-10-26T14:41:03Z",
  "published": "2026-10-15T20:20:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77564"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/pull/13345"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/pull/13434"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/pull/13611"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siderolabs/talos"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/releases/tag/v1.12.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siderolabs/talos/releases/tag/v1.13.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Talos Linux: Support bundle does not redact registry credentials"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77564 (GCVE-0-2026-77564)

FKIE_CVE-2026-77564

GHSA-7CXH-94CF-MFP6

Summary

Details

PoC

Impact

Notes

Environment

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour