Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T16:56:04 pnpm: pnpm: Information disclosure of authentication credentials via malicious .npmrc file 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE-201

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.

A flaw was found in pnpm, a package manager. This vulnerability allows pnpm to send user-level unscoped npm authentication credentials to a registry specified by a repository-local .npmrc file. During normal pnpm operations, the user's authentication token, intended for their default registry, can be inadvertently sent to a different, potentially malicious, registry. This could lead to the unauthorized disclosure of sensitive authentication tokens.

This Moderate impact information disclosure flaw in pnpm allows an attacker to obtain user-level unscoped npm authentication credentials. When a user runs pnpm commands in a repository with a malicious local `.npmrc` file, their authentication token, intended for their default registry, can be redirected to an attacker-controlled registry. This risk is heightened as the credential leak occurs before any package code execution, affecting Red Hat products that utilize pnpm. To mitigate this issue, ensure that all npm authentication tokens are explicitly URL-scoped rather than relying on unscoped, user-level configurations. Additionally, avoid executing pnpm commands in untrusted repositories, as a malicious `.npmrc` file can redirect authentication credentials to an attacker. Red Hat AMQ Broker 7 Fix deferred pnpm Red Hat Build of Keycloak Fix deferred pnpm Red Hat JBoss Enterprise Application Platform 8 Fix deferred pnpm Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred pnpm https://www.cve.org/CVERecord?id=CVE-2026-50017 https://nvd.nist.gov/vuln/detail/CVE-2026-50017 https://github.com/pnpm/pnpm/security/advisories/GHSA-cjhr-43r9-cfmw