CVE-2026-77564 is a low-severity (CVSS 3.3) CWE-312 vulnerability in github.com/talos-systems/talos. A fix is available for github.com/talos-systems/talos — see the affected versions and patch details below.
Talos Linux: Support bundle does not redact registry credentials
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-77564 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,803 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
github.com/talos-systems/talosReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
When generating a support bundle with talosctl support the credentials entered for private registries are included in the bundle.
Details
Within the generated support bundle, inside resources/registryconfigs.cri.talos.dev.yaml the auth field of the spec is retained.
The same, potentially sensitive information is present within etcfilespecs.files.talos.dev.yaml.
PoC
Simply run talosctl -n [...] support on a cluster with a RegistryAuthConfig resource
Impact
The problem itself is minor, however, anyone who has ever uploaded a support.zip bundle on a github issue, slack thread or public forum could have potentially leaked their internal authentication parameters for a private registry.
In most situations, if the network and credentials are set correctly, this should not be a problem. On the other hand, if the affected registry is publicly accessible, and the provided credentials have write access to it, this could lead to possibly serious consequences, from denial of service, to data loss and possibly existing tag hijacking leading to supply chain compromise, for the affected parties which were under the impression that the support bundle is redacted of sensitive information and thus can be shared publicly.
Notes
Talos 1.14+ by default encrypts the support bundle to the age recipients specified (defaulting to siderolabs GitHub org members), so the impact is even lower.
Environment
- Talos version: v1.13.0
- Kubernetes version: 1.35.3
- Platform: amd64
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/talos-systems/talos | all versions | 1.14.0-alpha.0.0.20260513110206-76080416beeego get github.com/talos-systems/talos@v1.14.0-alpha.0.0.20260513110206-76080416beee |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/talos-systems/talos, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update github.com/talos-systems/talos to 1.14.0-alpha.0.0.20260513110206-76080416beee or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-77564 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Frequently Asked Questions
Is CVE-2026-77564 in your dependencies?
Find it across Go, including transitive dependencies.