CVE-2026-59891 sigstore CVE debrief

Who should care

Developers and administrators using sigstore-js for interacting with Sigstore services should update to version 0.7.1 or later to mitigate this vulnerability. This includes anyone who uses sigstore-js in their applications or infrastructure. The vulnerability has a high CVSS score of 9.6, indicating that it is a critical issue that requires immediate attention. Security teams and vulnerability management teams should also be aware of this vulnerability and take steps to identify and remediate affected systems.

Technical summary

The vulnerability in sigstore-js prior to 0.7.1 was due to the getRegistryCredentials() function reading credentials from the Docker config file and selecting an entry based on a substring match of the target registry string with any configured auth key. This could lead to credentials being transmitted to the wrong registry. The fix in version 0.7.1 ensures an exact host match is required. The vulnerability has a CVSS score of 9.6, indicating a high severity level. The affected product is sigstore-js, and the vulnerability affects versions prior to 0.7.1.

Defensive priority

High

Recommended defensive actions

• Update sigstore-js to version 0.7.1 or later
• Review and update Docker config files to ensure secure registry credentials are properly configured
• Monitor for any unauthorized access or credential misuse
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-14T17:17:15.270Z and last modified on 2026-07-21T19:17:12.150Z. The NVD entry is currently Awaiting Analysis. There is limited information available about the vulnerability beyond the initial CVE record and NVD entry. Further verification and analysis are needed to fully understand the impact and scope of the vulnerability. The sigstore-js library is used for interacting with Sigstore services, and the vulnerability affects versions prior to 0.7.1. The getRegistryCredentials() function reads credentials from the Docker config file and selects an entry based on a substring match of the target registry string with any configured auth key. This could lead to credentials being transmitted to the wrong registry. The fix in version 0.7.1 ensures an exact host match is required. Evidence limits suggest that additional information may be available through Sigstore service documentation or related security advisories.

Official resources