Detections
Analytics

SCA: security update for github.com/talos-systems/talos (GHSA-7cxh-94cf-mfp6)

low Tenable Cloud Security Plugin ID 474702

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl
 support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content
 from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those
 resources. An operator who shares a bundle with an unintended party can therefore disclose private
 registry authentication parameters, with impact depending on the registry's network exposure and
 credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not
 replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3. (CVE-2026-77564)

Solution

Update the github.com/talos-systems/talos library and its related packages to version 1.14.0-alpha.0.0.20260513110206-76080416beee or later.

See Also

https://github.com/advisories/GHSA-7cxh-94cf-mfp6

Plugin Details

Severity: Low

ID: 474702

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-77564

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 2.9

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/15/2026

Vulnerability Publication Date: 10/14/2026

Reference Information

CVE: CVE-2026-77564

cwe: CWE-312