CVE-2025-61776

Dependency-Track prior to version 4.13.5 is affected by a credential leakage vulnerability where credentials intended for a private NuGet repository can be sent to api.nuget.org via the HTTP Authorization header, and names/versions of internal components can be disclosed to api.nuget.org. This sc...

CVE-2025-61776 Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org

Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.13.5, Dependency-Track may send credentials meant for a private NuGet repository to api.nuget.org via the HTTP Authorization header, and may...