Product:
container
Summary
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This vulnerability poses a significant risk to user confidentiality. The issue has been addressed in a recent update.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-28909 |
Exploitation
To exploit this vulnerability, an attacker can set up a malicious registry with a hostname that matches the bypass patterns. When users connect to this registry, their credentials will be transmitted in plaintext, allowing the attacker to capture sensitive information without requiring any special privileges.
Affected Products
- container: Affected version allows credential exposure when connecting to malicious registries.
Mitigation
To mitigate this vulnerability, users should update to the fixed version of the container software. Additionally, users should avoid connecting to unknown or untrusted registries to prevent credential exposure.