Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
CVE-2026-49349: regclient may leak registry credentials to external servers
CVE-2026-49349 · published 2 months ago
Summary
The regclient tool can leak authentication credentials to external servers if it fetches an image from a malicious registry or blob store. This could allow an attacker to gain unauthorized access to a registry server. To protect against this, ensure you are using the latest version of regclient.
What to do
- Update github.com regclient to version 0.11.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | regclient |
<= 0.11.4 Fix: upgrade to 0.11.5
|
| – | regclient | regclient | < 0.11.5 |
Original advisory text
regclient may leak authentication credentials to external blob stores
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.
References
- https://github.com/advisories/GHSA-qvqc-4c52-x6qp
- https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49349... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49349 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-522Insufficiently Protected Credentials
Timeline
Published12 Aug 2026
Updated31 Oct 2026
First seen26 Jun 2026
Track software like this
Free during beta