CVE-2026-28909

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext

Medium · published April 30, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00322 · 24.0th percentile
Published
2026-04-30T22:00Z
EPSS history
Timeline
  • 30 APR 22:00Z
    Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext
    cvelistv5