Vulnerability · Published Aug 12, 2026 · Assigned by GitHub_M
CVE-2026-49349regclient may leak authentication credentials to external blob stores
Medium 6.8
In plain English
A medium-severity security flaw in regclient from regclient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/regclient/regclient | 0.11.5 | GHSA-qvqc-4c52-x6qp |
| Go | github.com/regclient/regclient | 0.11.5 | GO-2026-5822 |
Affected products (as reported)
Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
References
- https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp x_refsource_CONFIRM