Description

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-12T16:17:20.093Z",
  "pubdate": "2026-08-12T16:17:20.093Z",
  "executiveSummary": "An unauthenticated cache poisoning vulnerability exists that allows malicious actors to cause untrusted package content to be stored within caching mechanisms under specific operational conditions. This flaw directly undermines artifact integrity and compromises system availability by potentially serving corrupted or malicious payloads to dependent consumers.\nThe vulnerability exposes package management, distribution, or caching infrastructure to integrity manipulation. Without requiring prior authentication, an attacker capable of triggering specific conditional states can manipulate the caching layer. This forces the system to ingest and retain illegitimate package artifacts, which are subsequently distributed as trusted dependencies.\nThe primary risk implication involves supply chain compromise through poisoned build pipelines, deployment of unauthorized code, and persistent denial of service conditions resulting from invalid or corrupted cache entries. Successful exploitation relies strictly on meeting the specific environmental or state conditions required by the caching mechanism to accept and store the untrusted content.\nMitigation requires enforcing stringent validation checks prior to cache ingestion, tightening cache key generation parameters, and ensuring cryptographic verification of all package contents before storage and distribution.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient validation and verification of package contents and metadata during the cache population phase. When specific execution conditions are met, the caching component fails to cryptographically verify or adequately inspect incoming package payloads against trusted sources before committing them to persistent storage.\nAn unauthenticated attacker interacts with the system by exploiting edge cases in the package ingestion or request handling logic. The attack flow begins when the adversary crafts a malicious package or payload designed to satisfy the specific conditions required for caching. By issuing targeted requests or manipulating input parameters that govern cache behavior, the attacker forces the caching layer to evaluate and subsequently store the untrusted package content.\nBecause no authentication or privilege requirements are mandated to trigger the vulnerable state, external network actors can submit payloads directly to exposed ingestion endpoints. The payload behavior involves mimicking legitimate package structures while containing arbitrary or malicious code designed to compromise downstream consumers.\nUpon successful exploitation, the post-exploitation impact includes persistent artifact contamination. Subsequent requests for the affected packages retrieve the cached malicious content, leading to compromised build artifacts, execution of unauthorized code in dependent environments, and severe availability disruptions due to corrupted or broken package dependencies stored within the infrastructure."
}