Vulnerability in Siderolabs Talos
CVE-2026-77564
Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.
Published .
CVSS v3 metric
CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Siderolabs Talos — versions < 1.12.9, >= 1.13.0, < 1.13.3
Weakness classification (CWE)
References
- github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6
- github.com/siderolabs/talos/pull/13345
- github.com/siderolabs/talos/pull/13434
- github.com/siderolabs/talos/pull/13611
- github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142
- github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e
- github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb
- github.com/siderolabs/talos/releases/tag/v1.12.9
- github.com/siderolabs/talos/releases/tag/v1.13.3
Frequently asked questions
- What is CVE-2026-77564?
- CVE-2026-77564 is a low-severity vulnerability in Siderolabs Talos, classified under Cleartext Storage of Sensitive Information. CVSS score: 3.3/10. Published 2026-10-14.
- How severe is CVE-2026-77564?
- Low severity. CVSS v3 base score is 3.3 out of 10.