@sigstore/oci EUVD-2026-113272

Exploitation requires the victim to actively push a signed artifact or attestation through @sigstore/oci's attachArtifactToImage() (reachable via OCIImage.addArtifact() -> RegistryClient.signIn() -> uploadBlob()) to an OCI registry that is malicious, compromised, or impersonated, and that returns an absolute blob-upload Location header pointing to a different host than the registry. The leak occurs because signIn() installs the registry Authorization (Bearer token or Basic username:password) and Docker config headers as client-wide defaults via .defaults(), and uploadBlob() sends a fresh explicit PUT to the absolute Location with no check that its host or scheme matches the registry origin; the HTTP layer's cross-host redirect stripping does not apply because this PUT is a new request, not a followed redirect. Limiting factors: affects only @sigstore/oci <= 0.7.1; requires the user-initiated push (UI:R); and requires the attacker to control or impersonate the registry's response - it is not exploitable against an honest registry.

This is a credential-disclosure flaw (CWE-522) in @sigstore/oci rated 7.4 by the input CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, but the signals conflict on attack complexity: the mechanism requires a malicious, compromised, or impersonated OCI registry that returns an absolute cross-host blob-upload Location, which is attacker-situational rather than a condition the attacker freely controls, so the GHSA author's AC:H (6.8) is better defended than the input's AC:L - verify complexity with the vendor. No CISA KEV listing is present (not actively exploited per available data), and no EPSS probability was supplied, so widespread automated exploitation cannot be inferred from the data. There is no public exploit identified at time of analysis - the GHSA advisory is an explicitly source-verified trace, with its author stating no live push against a hostile registry was executed. Net: a genuine high-impact credential leak (registry bearer token or raw Basic username:password), but gated behind user interaction (an artifact push) and a hostile registry, consistent with the vuln.today 'this_week' decision label rather than an emergency; prioritize patching for anyone pushing artifacts to untrusted or redirect-capable registries.

A developer uses a tool built on @sigstore/oci to push a signed artifact to an OCI registry via attachArtifactToImage(). A malicious or compromised registry responds to the blob-upload POST with an absolute Location header pointing to an attacker-controlled host; because signIn() installed the credential as a client-wide default header, uploadBlob() PUTs the blob to that host with the registry Authorization (bearer token or Basic username:password) and custom Docker headers still attached, handing the credential to the attacker. No working public exploit exists; the GHSA provides only a source-verified reachability trace. Attack complexity is effectively high since it depends on the registry returning a hostile cross-host Location.