Talos Linux support bundles generated by talosctl before version 1.12.9 and 1.13.3 include the full authentication field from registry configuration resources and sensitive data from file specifications. When an operator shares a bundle with an unintended party, the registry authentication parameters are exposed, allowing the recipient to potentially access private container registries and any images or resources protected by those credentials.

The vulnerability affects the Talos Linux distribution from siderolabs. Versions prior to 1.12.9 and 1.13.3 are impacted. Talos 1.14 and later versions encrypt support bundles by default, which mitigates but does not eliminate the need for redaction of sensitive fields.

The CVSS score of 3.3 indicates a low impact on confidentiality, integrity, or availability. The EPSS score of <1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an operator who distributes an unredacted support bundle to an unintended party, potentially exposing registry authentication credentials. This does not allow arbitrary code execution and is considered a low‑severity data leakage issue.