CVE-2026-77564

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77564
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77564.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77564
Aliases
  • GHSA-7cxh-94cf-mfp6
Published
2026-10-14T16:09:11Z
Modified
2026-10-15T02:47:39Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Talos Linux: Support bundle does not redact registry credentials
Details

Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-312"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77564.json"
}
References

Affected packages

Git / github.com/siderolabs/talos

Affected ranges

Type
GIT
Repo
https://github.com/siderolabs/talos
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
150ee5ba0a332808d2dce4452a049d971feb6323
Introduced
b9e9c657963363da73b897c27ef3d407ba5e91c0
Fixed
befeda7cb3b8a771a965e0f944b13d80b8151a95
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.12.9"
        },
        {
            "introduced":  "1.13.0"
        },
        {
            "fixed":  "1.13.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

pkg/machinery/v0.*
pkg/machinery/v0.12.0-alpha.0
pkg/machinery/v0.13.0-alpha.0
pkg/machinery/v0.13.0-alpha.1
pkg/machinery/v0.13.0-alpha.2
pkg/machinery/v0.13.0-alpha.3
pkg/machinery/v0.14.0-alpha.0
pkg/machinery/v0.14.0-alpha.1
pkg/machinery/v0.14.0-alpha.2
pkg/machinery/v0.14.0-beta.0
pkg/machinery/v0.15.0-alpha.0
pkg/machinery/v0.15.0-alpha.1
pkg/machinery/v0.15.0-alpha.2
pkg/machinery/v1.*
pkg/machinery/v1.0.0-beta.0
pkg/machinery/v1.1.0-alpha.0
pkg/machinery/v1.1.0-alpha.1
pkg/machinery/v1.1.0-alpha.2
pkg/machinery/v1.10.0-alpha.0
pkg/machinery/v1.10.0-alpha.1
pkg/machinery/v1.10.0-alpha.2
pkg/machinery/v1.10.0-alpha.3
pkg/machinery/v1.11.0-alpha.0
pkg/machinery/v1.11.0-alpha.1
pkg/machinery/v1.11.0-alpha.2
pkg/machinery/v1.11.0-alpha.3
pkg/machinery/v1.12.0
pkg/machinery/v1.12.0-alpha.0
pkg/machinery/v1.12.0-alpha.1
pkg/machinery/v1.12.0-alpha.2
pkg/machinery/v1.12.0-beta.0
pkg/machinery/v1.12.0-beta.1
pkg/machinery/v1.12.0-rc.0
pkg/machinery/v1.12.0-rc.1
pkg/machinery/v1.12.1
pkg/machinery/v1.12.2
pkg/machinery/v1.12.3
pkg/machinery/v1.12.4
pkg/machinery/v1.12.5
pkg/machinery/v1.12.6
pkg/machinery/v1.12.8
pkg/machinery/v1.13.0
pkg/machinery/v1.13.1
pkg/machinery/v1.13.2
pkg/machinery/v1.2.0-alpha.0
pkg/machinery/v1.2.0-alpha.1
pkg/machinery/v1.2.0-alpha.2
pkg/machinery/v1.3.0-alpha.0
pkg/machinery/v1.3.0-alpha.1
pkg/machinery/v1.3.0-alpha.2
pkg/machinery/v1.4.0-alpha.0
pkg/machinery/v1.4.0-alpha.1
pkg/machinery/v1.4.0-alpha.2
pkg/machinery/v1.4.0-alpha.3
pkg/machinery/v1.4.0-alpha.4
pkg/machinery/v1.5.0-alpha.1
pkg/machinery/v1.5.0-alpha.2
pkg/machinery/v1.5.0-alpha.3
pkg/machinery/v1.6.0-alpha.0
pkg/machinery/v1.6.0-alpha.1
pkg/machinery/v1.6.0-alpha.2
pkg/machinery/v1.7.0-alpha.1
pkg/machinery/v1.8.0-alpha.0
pkg/machinery/v1.8.0-alpha.1
pkg/machinery/v1.8.0-alpha.2
pkg/machinery/v1.9.0-alpha.0
pkg/machinery/v1.9.0-alpha.1
pkg/machinery/v1.9.0-alpha.2
pkg/machinery/v1.9.0-alpha.3
v0.*
v0.1.0-alpha.0
v0.1.0-alpha.1
v0.1.0-alpha.10
v0.1.0-alpha.11
v0.1.0-alpha.12
v0.1.0-alpha.13
v0.1.0-alpha.14
v0.1.0-alpha.15
v0.1.0-alpha.16
v0.1.0-alpha.17
v0.1.0-alpha.18
v0.1.0-alpha.19
v0.1.0-alpha.2
v0.1.0-alpha.20
v0.1.0-alpha.21
v0.1.0-alpha.22
v0.1.0-alpha.23
v0.1.0-alpha.24
v0.1.0-alpha.25
v0.1.0-alpha.26
v0.1.0-alpha.27
v0.1.0-alpha.28
v0.1.0-alpha.3
v0.1.0-alpha.4
v0.1.0-alpha.5
v0.1.0-alpha.6
v0.1.0-alpha.7
v0.1.0-alpha.8
v0.1.0-alpha.9
v0.1.0-beta.0
v0.10.0-alpha.0
v0.10.0-alpha.1
v0.10.0-alpha.2
v0.11.0-alpha.0
v0.11.0-alpha.1
v0.11.0-alpha.2
v0.12.0-alpha.0
v0.12.0-alpha.1
v0.13.0-alpha.0
v0.13.0-alpha.1
v0.13.0-alpha.2
v0.13.0-alpha.3
v0.14.0-alpha.0
v0.14.0-alpha.1
v0.14.0-alpha.2
v0.15.0-alpha.0
v0.15.0-alpha.1
v0.15.0-alpha.2
v0.2.0-alpha.0
v0.2.0-alpha.1
v0.2.0-alpha.2
v0.2.0-alpha.3
v0.2.0-alpha.4
v0.2.0-alpha.5
v0.2.0-alpha.6
v0.2.0-alpha.7
v0.2.0-beta.0
v0.3.0-alpha.0
v0.3.0-alpha.1
v0.3.0-alpha.10
v0.3.0-alpha.2
v0.3.0-alpha.3
v0.3.0-alpha.4
v0.3.0-alpha.5
v0.3.0-alpha.6
v0.3.0-alpha.7
v0.3.0-alpha.8
v0.3.0-alpha.9
v0.3.0-beta.0
v0.4.0-alpha.0
v0.4.0-alpha.1
v0.4.0-alpha.2
v0.4.0-alpha.3
v0.4.0-alpha.4
v0.4.0-alpha.5
v0.4.0-alpha.6
v0.4.0-alpha.7
v0.4.0-alpha.8
v0.5.0-alpha.0
v0.5.0-alpha.1
v0.5.0-alpha.2
v0.6.0-alpha.0
v0.6.0-alpha.1
v0.6.0-alpha.2
v0.6.0-alpha.3
v0.6.0-alpha.4
v0.6.0-alpha.5
v0.6.0-alpha.6
v0.7.0-alpha.0
v0.7.0-alpha.1
v0.7.0-alpha.2
v0.7.0-alpha.3
v0.7.0-alpha.4
v0.7.0-alpha.5
v0.7.0-alpha.6
v0.7.0-alpha.7
v0.7.0-alpha.8
v0.8.0-alpha.0
v0.8.0-alpha.1
v0.8.0-alpha.2
v0.8.0-alpha.3
v0.9.0-alpha.0
v0.9.0-alpha.1
v0.9.0-alpha.2
v0.9.0-alpha.3
v0.9.0-alpha.4
v0.9.0-alpha.5
v1.*
v1.1.0-alpha.0
v1.1.0-alpha.1
v1.1.0-alpha.2
v1.10.0-alpha.0
v1.10.0-alpha.1
v1.10.0-alpha.2
v1.10.0-alpha.3
v1.11.0-alpha.0
v1.11.0-alpha.1
v1.11.0-alpha.2
v1.11.0-alpha.3
v1.12.0
v1.12.0-alpha.0
v1.12.0-alpha.1
v1.12.0-alpha.2
v1.12.0-beta.0
v1.12.0-beta.1
v1.12.0-rc.0
v1.12.0-rc.1
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.7
v1.12.8
v1.13.0
v1.13.1
v1.13.2
v1.2.0-alpha.0
v1.2.0-alpha.1
v1.2.0-alpha.2
v1.3.0-alpha.0
v1.3.0-alpha.1
v1.3.0-alpha.2
v1.4.0-alpha.0
v1.4.0-alpha.1
v1.4.0-alpha.2
v1.4.0-alpha.3
v1.4.0-alpha.4
v1.5.0-alpha.0
v1.5.0-alpha.1
v1.5.0-alpha.2
v1.5.0-alpha.3
v1.6.0-alpha.0
v1.6.0-alpha.1
v1.6.0-alpha.2
v1.7.0-alpha.0
v1.7.0-alpha.1
v1.8.0-alpha.0
v1.8.0-alpha.1
v1.8.0-alpha.2
v1.9.0-alpha.0
v1.9.0-alpha.1
v1.9.0-alpha.2
v1.9.0-alpha.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77564.json"