CVE-2026-49349 in regclient

Sumário

de MITRE • 12/08/2026

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsável: GitHub M
• Reservar: 29/05/2026
• Divulgação: 12/08/2026
• Moderação: aceite
• Entrada: VDB-389026
• CPE: pronto
• CWE: CWE-200 (confirmado)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00000
• KEV: não
• Atividades: muito baixo

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-49349
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49349
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-49349/