CVE-2026-24845
Unknown Unknown - Not Provided
Credential Exposure via Malicious OCI Image in malcontent

Publication date: 2026-01-29

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description
malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a `WWW-Authenticate` header redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint. Version 1.20.3 fixes the issue by defaulting to anonymous auth for OCI pulls.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-29
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-01-30
EPSS Evaluated
2026-06-14
NVD
CVE-2026-24845
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
chainguard malcontent From 0.1.0 (inc) to 1.20.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in malcontent versions 0.10.0 up to before 1.20.3 allows a malicious Docker registry to trick malcontent into exposing Docker registry credentials. It happens because malcontent uses google/go-containerregistry, which by default uses the Docker credential keychain. A specially crafted OCI image reference can cause the registry to send a WWW-Authenticate header that redirects token authentication to an attacker-controlled endpoint, resulting in credentials being sent to the attacker. The issue is fixed in version 1.20.3 by defaulting to anonymous authentication for OCI pulls.

Impact Analysis

This vulnerability can lead to the exposure of your Docker registry credentials to an attacker-controlled endpoint. This could allow attackers to gain unauthorized access to your Docker registries, potentially leading to further compromise of your container images, supply chain, or infrastructure.

Mitigation Strategies

Upgrade malcontent to version 1.20.3 or later, as this version fixes the issue by defaulting to anonymous authentication for OCI image pulls, preventing exposure of Docker registry credentials.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24845. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart