Grype has a credential disclosure vulnerability in Grype JSON output
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file> option, the registry credentials will be included unsanitized in the output file. This issue has been patched in version 0.104.1. Users running affected versions of grype can work around this vulnerability by redirecting stdout to a file instead of using the --file or --output options.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| anchore | grype | 0.68.0 to before 0.104.1 | 0.104.1 | Patch available | CNA |
| — | github.com/anchore/grype (Go) | 0.68.0 to before 0.104.1 | 0.104.1 | Patch available | GHSA-6gxw-85q2-q646 |
- grype Vendoranchore Affected 0.68.0 to before 0.104.1 Fixed in 0.104.1 Patch available CNA
- github.com/anchore/grype (Go) Vendor— Affected 0.68.0 to before 0.104.1 Fixed in 0.104.1 Patch available GHSA-6gxw-85q2-q646
Remediation
- Fix · CNA grype (anchore) Fixed in 0.104.1
- Fix · GHSA-6gxw-85q2-q646 github.com/anchore/grype (Go) Fixed in 0.104.1 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-65965
- 2026-10-03 Alias added: GHSA-6gxw-85q2-q646
References
Other 5
- https://github.com/anchore/grype/security/advisories/GHSA-6gxw-85q2-q646
- https://github.com/anchore/grype/pull/3068
- https://github.com/anchore/grype/commit/39f7fa17af2739cafe9b27176d4a68f7c05f21c1
- https://github.com/anchore/grype/commit/c99f79de49a58dc16d7fd8f35160b169b87db9de
- https://github.com/anchore/grype
More anchore vulnerabilities
- TI-2024-16200 Tar path traversal in stereoscope when processing OCI tar archives CVSS 3.1CRITICAL 9.8
- TI-2023-10327 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft CVSS 3.1HIGH 7.5
- TI-2020-08949 Shell Escape in Anchore Engine CVSS 3.1CRITICAL 9.9
- TI-2026-45314 Anchore Enterprise Privilege Escalation via User Management API CVSS 4.0HIGH 8.7
- TI-2026-20256 Anchore Enterprise GraphQL Reports API SQL injection CVSS 4.0HIGH 8.5
- TI-2022-01632 Insufficiently protected credentials in Anchore Enterprise CVSS 3.1HIGH 7.5
Sources
- CVE-2025-65965 · CVE Program
- CVE-2025-65965 · NVD
- FIRST EPSS
- GHSA-6gxw-85q2-q646 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-65965 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences