CVE-2026-77564

The record

Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.

Affected packages

Related vulnerabilities

• CVE-2026-110200 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to… CWE-312
• CVE-2026-116691 MLflow is an open source AI engineering platform for agents, large language models, and… CWE-312
• CVE-2026-115400 crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows… CWE-312
• CVE-2026-96293 A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint… CWE-312
• CVE-2026-114223 NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information… CWE-312
• CVE-2026-86280 A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management &… CWE-312
• CVE-2026-53603 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-312
• CVE-2026-73748 A vulnerability in the affected interface of HPE Networking Fabric Composer allows an… CWE-312