CVE-2026-49349
MediumCVSS 6.8Summary
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.
Risk Assessment
Risk of credential leakage to external servers, potentially leading to unauthorized access to container registries.
Recommendation
Upgrade regclient to version 0.11.5 or later and avoid using untrusted registries.
Original NVD description (English source)
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.