CVE-2026-50017

[CVE catalog]

Severity

Medium · CVSS 6.9

Published

Jun 25, 2026, 4:56:04 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.44% · Oct 25, 2026

A flaw was found in pnpm, a package manager. This vulnerability allows pnpm to send user-level unscoped npm authentication credentials to a registry specified by a repository-local .npmrc file. During normal pnpm operations, the user's authentication token, intended for their default registry, can be inadvertently sent to a different, potentially malicious, registry. This could lead to the unauthorized disclosure of sensitive authentication tokens. pnpm: pnpm: Information disclosure of authentication credentials via malicious .npmrc file This Moderate impact information disclosure flaw in pnpm allows an attacker to obtain user-level unscoped npm authentication credentials. When a user runs pnpm commands in a repository with a malicious local `.npmrc` file, their authentication token, intended for their default registry, can be redirected to an attacker-controlled registry. This risk is heightened as the credential leak occurs before any package code execution, affecting Red Hat products that utilize pnpm. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.