cve.bz

CVE-2026-49349

6.8 mediumEPSS 0.3%

Medium (6.8). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/regclient/regclient 0.11.5.

regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.

Severity

CVSS 3.1

6.8 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE
CWE-522
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-qvqc-4c52-x6qpGogithub.com/regclient/regclient<0.11.50.11.5
GO-2026-5822Gogithub.com/regclient/regclient<0.11.50.11.5

References

Check your stackJSON