Description
@sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location
Recommendation
Update the @sigstore/oci package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.7.1
- Patched version(s): 0.7.2
References
Could your website be exposed too?
SmartScanner can check your website for @sigstore/oci sends the registry Authorization header to a cross-host blob-upload Location and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry - CVE-2026-59891
- OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data ex - CVE-2026-30956
- ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087
- Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection - CVE-2026-44486
You might also like:
See something that needs correcting? Let us knowUpdated October 30, 2026