CVE-2025-61776: Dependency-Track Information Disclosure

CVE-2025-61776 Overview

CVE-2025-61776 affects Dependency-Track, an open-source component analysis platform used to identify and reduce risk in the software supply chain. Versions prior to 4.13.5 can leak private NuGet repository credentials to api.nuget.org through the HTTP Authorization header. The flaw also discloses the names and versions of components marked as internal to the public NuGet index.

The issue triggers when Dependency-Track scans .NET components and a custom NuGet repository with authentication is configured, but the repository server does not advertise a PackageBaseAddress resource in its service index. This condition falls under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Private NuGet repository credentials and internal component metadata may be transmitted to api.nuget.org, enabling credential theft and supply chain reconnaissance.

Affected Products

Dependency-Track versions prior to 4.13.5
Deployments configured with custom authenticated NuGet repositories
Instances scanning .NET components where the custom NuGet server omits PackageBaseAddress

Discovery Timeline

2025-10-07 - CVE-2025-61776 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61776

Vulnerability Analysis

Dependency-Track queries NuGet repositories to resolve metadata for .NET components. When a custom NuGet repository is configured with credentials, the platform should send the Authorization header only to that repository. The vulnerability causes Dependency-Track to fall back to api.nuget.org while retaining the Authorization header intended for the private repository.

The fallback also transmits the internal component name and version to the public NuGet index. An attacker or third party with access to api.nuget.org request logs, or with control over that endpoint, can capture the leaked credentials and identify internal .NET packages used inside the organization.

Root Cause

The root cause is missing scope enforcement on the Authorization header during repository fallback. When the configured private repository service index lacks the PackageBaseAddress resource, Dependency-Track redirects the lookup to api.nuget.org but does not strip the credentials bound to the private repository. This mishandling of authentication material aligns with [CWE-522].

Attack Vector

Exploitation does not require authentication to Dependency-Track. An attacker must observe or control traffic reaching api.nuget.org, or gain access to logs on that service. The attacker then extracts the Authorization header value and reuses the credentials against the victim's private NuGet repository. The disclosure of internal component names supports downstream dependency confusion or targeted supply chain attacks. The vulnerability manifests only when the specific configuration prerequisites are met; see the GitHub Security Advisory GHSA-83g2-vgqh-mgxc for the full technical description.

Detection Methods for CVE-2025-61776

Indicators of Compromise

Outbound HTTPS requests from Dependency-Track hosts to api.nuget.org carrying an Authorization header
Presence of internal .NET package names or versions in api.nuget.org access telemetry
Custom NuGet repository configuration in Dependency-Track where the service index omits PackageBaseAddress

Detection Strategies

Inspect Dependency-Track egress traffic via TLS-terminating proxies to identify requests to api.nuget.org that include Authorization headers
Audit Dependency-Track configuration for custom NuGet repositories and verify each repository's service index exposes the PackageBaseAddress resource
Correlate authentication failures or anomalous logins on the private NuGet repository against the disclosure window

Monitoring Recommendations

Log and alert on any outbound request from the Dependency-Track instance to public package registries that includes credential headers
Monitor private NuGet repository access logs for reuse of previously issued credentials from unexpected source addresses
Track version drift of the Dependency-Track deployment to confirm remediation to 4.13.5 or later

How to Mitigate CVE-2025-61776

Immediate Actions Required

Upgrade Dependency-Track to version 4.13.5 or later using the artifacts in the GitHub Release Notes 4.13.5
Invalidate every credential previously configured for a custom NuGet repository in Dependency-Track
Issue new NuGet repository credentials only after the patched version is running
Review outbound traffic and package registry logs for evidence of credential exposure

Patch Information

The fix is included in Dependency-Track 4.13.5. The patched release enforces that the Authorization header is only transmitted to the configured private repository and is stripped when the client falls back to api.nuget.org. Refer to the GitHub Security Advisory GHSA-83g2-vgqh-mgxc for advisory metadata.

Workarounds

Disable custom NuGet repositories in Dependency-Track until version 4.13.5 is deployed
Revoke and rotate all credentials previously supplied to custom NuGet repository configurations
Reconfigure the private NuGet repository to expose the PackageBaseAddress resource in its service index to prevent the fallback path

bash

# Configuration example: verify running version and upgrade
curl -s https://dependency-track.example.local/api/version | jq .version
# Pull the patched container image
docker pull dependencytrack/apiserver:4.13.5
docker pull dependencytrack/frontend:4.13.5