CVE-2026-65388CWE-601
CVE-2026-65388
High · published September 17, 2026
What it is
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0.
The record
Technical detail
- CVSS v3.1
- 7.5 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00432 · 36.5th percentile
- Weakness
- CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
- Published
- 2026-09-17T03:16Z
References (1)
EPSS history
Timeline