CVE-2026-77564Low· 3.3▾ SunlitTalos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.ta…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/talos-systems/talos < 1.14.0-alpha.0.0.20260513110206-76080416beeePatched in:
github.com/talos-systems/talos 1.14.0-alpha.0.0.20260513110206-76080416beeeConnected by shared product, vendor, weakness, or advisory.
CVE-2026-62376High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-107807High· 8.8Nginx UI is a web user interface for the Nginx web server
CVE-2026-63406Medium· 5.9AnyCable is a realtime server for reliable two-way communication that supports any backend
CVE-2026-91982Medium· 4.3Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/qrcode endpoints without re-authentication
CVE-2026-42151High· 7.5Prometheus is an open-source monitoring system and time series database
CVE-2026-77250Medium· 6.1MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira)