{"items":[{"id":"NVI-00010638","kind":"vulnerability","title":"Talos Linux: Support bundle does not redact registry credentials","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-7cxh-94cf-mfp6","CVE-2026-77564"],"plain_summary":"GitHub lists this reviewed advisory for github.com/siderolabs/talos. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-35a6e1a353b6f2ec85d97b12f44654e7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T14:41:05.000Z","value":"3.3 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-7cd84bc1b3335d1ef38bdc717c9dce62"},{"kind":"CVSS","as_of":"2026-10-29T15:17:24.197Z","value":"3.3 LOW (3.1)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-35a6e1a353b6f2ec85d97b12f44654e7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7cd84bc1b3335d1ef38bdc717c9dce62","url":"https://github.com/advisories/GHSA-7cxh-94cf-mfp6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7cxh-94cf-mfp6","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"},{"id":"sr-35a6e1a353b6f2ec85d97b12f44654e7","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77564","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-77564","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-04T09:59:04.406Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7cd84bc1b3335d1ef38bdc717c9dce62"],"technology":"github.com/siderolabs/talos","known_exclusions":[],"conditions_summary":"### Summary\nWhen generating a support bundle with `talosctl support` the credentials entered for private registries are included in the bundle.\n\n\n### Details\n\nWithin the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.\nThe same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.\n\n### PoC\n\nSimply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource \n\n### Impact\n\nThe problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.\n\nIn most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is","public_affected_ranges":["< 1.14.0-alpha.0.0.20260513110206-76080416beee"]}],"null_published_at":"2026-11-04T10:04:35.930Z","source_updated_at":"2026-10-26T14:41:05.000Z","source_disclosed_at":"2026-10-15T20:20:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T22:06:46.371Z"},{"id":"NVI-00010638","kind":"vulnerability","title":"Talos Linux: Support bundle does not redact registry credentials","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7cxh-94cf-mfp6","CVE-2026-77564"],"plain_summary":"GitHub lists this reviewed advisory for github.com/siderolabs/talos. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-7cd84bc1b3335d1ef38bdc717c9dce62"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-26T14:41:05.000Z","value":"3.3 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-7cd84bc1b3335d1ef38bdc717c9dce62"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-7cd84bc1b3335d1ef38bdc717c9dce62","url":"https://github.com/advisories/GHSA-7cxh-94cf-mfp6","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7cxh-94cf-mfp6","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:06:46.371Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-7cd84bc1b3335d1ef38bdc717c9dce62"],"technology":"github.com/siderolabs/talos","known_exclusions":[],"conditions_summary":"### Summary\nWhen generating a support bundle with `talosctl support` the credentials entered for private registries are included in the bundle.\n\n\n### Details\n\nWithin the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained.\nThe same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`.\n\n### PoC\n\nSimply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource \n\n### Impact\n\nThe problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.\n\nIn most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is","public_affected_ranges":["< 1.14.0-alpha.0.0.20260513110206-76080416beee"]}],"null_published_at":"2026-10-31T22:27:09.626Z","source_updated_at":"2026-10-26T14:41:05.000Z","source_disclosed_at":"2026-10-15T20:20:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:06:46.371Z"}],"next_cursor":null,"snapshot_revision":"42594"}