Talos Linux: Support bundle does not redact registry credentials

{
  "id": "bcd2ee52d98fb387a8cb6e4a412f659972157e4baa6611f41c616a1bd6b8f6bc",
  "url": "https://osv.dev/vulnerability/GHSA-7cxh-94cf-mfp6",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Talos Linux: Support bundle does not redact registry credentials",
    "summary": "### Summary When generating a support bundle with `talosctl support` the credentials entered for private registries are included in the bundle. ### Details Within the generated support bundle, inside `resources/registryconfigs.cri.talos.dev.yaml` the `auth` field of the spec is retained. The same, potentially sensitive information is present within `etcfilespecs.files.talos.dev.yaml`. ### PoC Simply run `talosctl -n [...] support` on a cluster with a `RegistryAuthConfig` resource ### Impact The problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry. In most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly. ### Notes Talos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower. ### Environment - Talos version: v1.13.0 - Kubernetes version: 1.35.3 - ",
    "evidence": "osv:GHSA-7cxh-94cf-mfp6",
    "products": [
      {
        "name": {
          "value": "github.com/siderolabs/talos",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.14.0-alpha.0.0.20260513110206-76080416beee",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "low",
    "structured": {
      "id": "GHSA-7cxh-94cf-mfp6",
      "aliases": [
        "CVE-2026-77564",
        "GHSA-7cxh-94cf-mfp6"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.14.0-alpha.0.0.20260513110206-76080416beee"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siderolabs/talos",
            "purl": "pkg:golang/github.com/siderolabs/talos",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7cxh-94cf-mfp6/GHSA-7cxh-94cf-mfp6.json"
          }
        }
      ],
      "modified": "2026-10-26T14:45:05.684976414Z",
      "provider": "osv",
      "references": [
        "https://github.com/siderolabs/talos/security/advisories/GHSA-7cxh-94cf-mfp6",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-77564",
        "https://github.com/siderolabs/talos/pull/13345",
        "https://github.com/siderolabs/talos/pull/13434",
        "https://github.com/siderolabs/talos/pull/13611",
        "https://github.com/siderolabs/talos/commit/4c288caf2de1db7f84bba0539ca5ed7d6ecb9142",
        "https://github.com/siderolabs/talos/commit/76080416beee6460375c0d0db3cab76cc493ad3e",
        "https://github.com/siderolabs/talos/commit/7dc716d850e43373ba8702c702105f4edd68fceb",
        "https://github.com/siderolabs/talos",
        "https://github.com/siderolabs/talos/releases/tag/v1.12.9",
        "https://github.com/siderolabs/talos/releases/tag/v1.13.3"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-312"
        ],
        "severity": "LOW",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-14T17:19:11Z",
        "github_reviewed_at": "2026-10-15T20:20:16Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-77564",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 454227,
  "published_at": "2026-10-15T20:20:16+00:00"
}