CVE-2026-50017: pnpm Credential Leakage via Repository .npmrc Files

Technical summary

CVE-2026-50017 is a credential binding vulnerability in pnpm prior to versions 10.34.0 and 11.4.0. The root cause is improper credential scope handling: when a repository specifies a registry URL in a local .npmrc file, pnpm incorrectly binds unscoped authentication tokens from the user's global npm configuration to that repository-chosen registry. The flaw occurs during dependency resolution and package installation workflows. An attacker controlling a repository can set registry= in .npmrc to point to an attacker-controlled registry, and if a user with stored credentials in their global npm config runs pnpm install or fetches metadata, the Authorization header carrying the user's token is sent to the attacker's registry. The vulnerability requires local repository access (via git clone or similar) and authenticated user interaction, limiting but not eliminating real-world risk.

Business impact

Compromised npm credentials pose significant supply chain risk. A leaked authentication token grants an attacker the ability to publish malicious packages under the affected user's identity, modify published packages if the user has maintainer rights, or access private packages. For organizations with developers using pnpm, this vulnerability creates a pathway for account takeover and potential insertion of backdoors into internal or public dependencies. The impact severity depends on the privileges associated with the leaked token and the number of projects that token can access.

Affected systems

All installations of pnpm prior to version 10.34.0 (if on the 10.x branch) or prior to version 11.4.0 (if on the 11.x branch or later) are vulnerable. The vulnerability applies only to users who have configured an unscoped _authToken in their user-level .npmrc configuration file and who run pnpm commands (install, add, or metadata operations) on repositories with attacker-controlled local .npmrc files. Developers and CI/CD systems running these pnpm versions are at risk.

Exploitability

Exploitability is moderate. The attack requires a repository under the attacker's control and a user with pre-configured npm credentials to clone and run pnpm commands on that repository. No network-level vulnerability or zero-day authentication bypass is needed—only social engineering or supply chain compromise (e.g., a popular repository being compromised). The CVSS vector (AV:N/AC:L/PR:L) reflects that network access and low attack complexity are required, with user interaction implicit in running pnpm on a cloned repository. Automated CI/CD pipelines that fetch and install dependencies are a high-risk vector, as they may operate with stored credentials and without human review of repository configurations.

Remediation

Upgrade pnpm immediately to version 10.34.0 or later (10.x users) or version 11.4.0 or later (11.x and newer users). Verify the upgrade by running 'pnpm --version' after installation. Additionally, conduct a token audit: rotate any npm authentication tokens that may have been exposed while running older pnpm versions, especially if you used pnpm on untrusted or third-party repositories. Review your global .npmrc for unscoped tokens and consider migrating to scoped token configurations or .npmrc file-based auth (e.g., per-registry tokens) to limit exposure.

Patch guidance

The patch is available in pnpm 10.34.0 and 11.4.0. Users on version 10.x should upgrade to 10.34.0; users on 11.x and later should upgrade to 11.4.0 or the latest available release. Verify against the official pnpm release notes at https://github.com/pnpm/pnpm/releases to confirm patch applicability and any breaking changes. For enterprise environments, test the upgrade in a non-production environment first, as pnpm minor and patch releases occasionally introduce behavioral changes in credential handling. If you maintain private registries, confirm compatibility before broad rollout.

Detection guidance

Examine pnpm version numbers across your development team and CI/CD infrastructure using 'pnpm --version' or querying package.json lock files (pnpm-lock.yaml). Check for pnpm installations older than 10.34.0 or 11.4.0. Review .npmrc files (both user-level at ~/.npmrc and repository-level) to identify which repositories have custom registry configurations and which users have unscoped _authToken entries. Enable audit logging on your npm registry to identify any unusual authentication attempts or package uploads from developer accounts during the vulnerability window. If your organization uses pnpm in CI/CD, audit job logs for authentication token exposure or unexpected registry requests.

Why prioritize this

While the CVSS score of 6.5 (MEDIUM) reflects limited attack complexity, the vulnerability is particularly relevant to development teams because it directly threatens credential security in a supply chain context. pnpm is popular among JavaScript/Node.js developers, and the attack surface includes any third-party or cloned repository. The lack of KEV designation does not diminish urgency—credential leakage vulnerabilities are actively exploited in the wild. Prioritize patching on machines and CI/CD pipelines with stored npm tokens, especially those running untrusted or frequently-updated dependencies.

Risk score, explained

The CVSS 6.5 (MEDIUM) score reflects: (1) Network-accessible attack vector (package installation is remote-capable); (2) low attack complexity (no special conditions required beyond repository cloning); (3) low privilege requirement (any authenticated npm user is at risk); (4) high confidentiality impact (full token disclosure); and (5) no integrity or availability impact from the vulnerability itself (though stolen tokens could enable downstream attacks). The score appropriately weights the credential exposure as a significant but not critical issue without cascading system compromise. Organizational risk may be higher if affected users have broad token privileges or control critical packages.

Frequently asked questions