ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-77564

Talos Linux is a Linux distribution built for Kubernetes deployments.

Published Oct 14, 2026 · catalog updated Oct 15, 2026 · Talos Linux is a

Check if you run it

No confirmed exploitation is on record for CVE-2026-77564. EPSS is 0.13%. Act only if a listed version of Talos Linux is a is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Talos Linux is a).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low3.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.13%
Remediation
Version ranges on file
Affected products
go github.com/talos-systems/talos · golang github.com

### Summary When generating a support bundle with the credentials entered for private registries are included in the bundle. ### Details Within the generated support bundle, inside the field of the spec is retained. The same, potentially sensitive information is present within . ### PoC Simply run on a cluster with a resource ### Impact The problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry. In most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly. ### Notes Talos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower. ### Environment - Talos version: v1.13.0 - Kubernetes version: 1.35.3 - Platform: amd64

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • go github.com/talos-systems/talos< 1.14.0-alpha.0.0.20260513110206-76080416beee
  • golang github.comversion unspecified

How to fix CVE-2026-77564

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-77564. EPSS is 0.13%. Act only if a listed version of Talos Linux is a is installed.

Which versions are affected?

Compare what you have installed with < 1.14.0-alpha.0.0.20260513110206-76080416beee. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-312: Cleartext Storage of Sensitive Information. EPSS 0.13%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Kubernetes security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore d

  2. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ### Summary When generating a support bundle with the credentials entered for private registries are included in the bundle. ### Details Within the generated support bundle, inside the field of the spec is retained. The same, potentially sensitive information is present within . ### PoC Simply run on a cluster with a resource ### Impact The problem itself is minor, however, anyone who has ever upl

Sources

  • CVE.orgVulnerability recordCVE-2026-77564

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-77564

    30-day exploitation probability 0.1%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-7cxh-94cf-mfp6

    Talos Linux: Support bundle does not redact registry credentials

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-77564

    When generating a support bundle with talosctl support the credentials entered for private registries are included in the bundle.

    advisories.gitlab.com
  • NIST NVDVulnerability recordCVE-2026-77564

    Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles i

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.