CVE-2026-49349

medium

Description

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.

References

https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57221

Details

Source: Mitre, NVD

Published: 2026-08-12

Updated: 2026-09-09

Named Vulnerability: GO-2026-5822Named Vulnerability: GHSA-qvqc-4c52-x6qp

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Severity: Medium

EPSS

EPSS: 0.00306