Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 pnpm, Credential Leakage, #CVE-2026-50017 (Critical) -DC-Jun2026-723 https://dailycve.com/pnpm-credential-leakage-cve-2026-50017-critical-dc-jun2026-723/
Post summary
A new CVE-2026-50017 is reported as a credential leakage vulnerability with critical severity; the post contains no exploit, PoC, or patch information.
CVE-2026-50017 pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .n… https://www.cve.org/CVERecord?id=CVE-2026-50017
Post summary
The text discloses that pnpm (prior to versions 10.34.0 and 11.4.0) may transmit unscoped npm authentication credentials to a registry selected via a local .npmrc file, providing a technical detail and indicating a patch is available.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pnpm | pnpm | - | node.js | - |