CVE-2026-49349
Received Received - Intake

Credentials Leak in regclient via Malicious Registry

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-08-12
AI Q&A
2026-08-12
EPSS Evaluated
N/A
NVD
CVE-2026-49349
EUVD
EUVD-2026-57221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
regclient regclient to 0.11.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in regclient (versions <= 0.11.4) allows authentication credentials for a registry to be leaked to external servers. It occurs when a malicious registry serves an OCI image manifest with a layer descriptor pointing to an attacker-controlled host. If the primary blob request fails, regclient may fetch the blob from the external URL and send registry credentials to the attacker.

Detection Guidance

Check regclient version with 'regclient version' or 'regctl version'. If version is <= 0.11.4, the system is vulnerable. Monitor network traffic for unexpected external blob requests or credential leaks during registry operations.

Impact Analysis

If exploited, this vulnerability could expose your registry credentials to attackers. This may lead to unauthorized access to your container images, potential data breaches, or further attacks within your infrastructure. The impact depends on the permissions of the compromised credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance violations, legal penalties, and reputational damage if credentials are leaked and used to access protected data.

Mitigation Strategies

Upgrade regclient to version 0.11.5 or later immediately. Ensure registries restrict external URLs for foreign blobs. Review registry configurations to prevent malicious blob redirects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49349. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart