146 matches found
CVE-2026-65388
Apple's containerization library (apple/container) is vulnerable to a credential disclosure attack. A remote attacker who controls a container registry can redirect a client's token request to an attacker-chosen host, leaking the victim's registry credentials . Rapid7 classifies the issue as URL ...
CVE-2026-85469
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...
CVE-2026-85469 Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope
A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...
cve-2026-59891-control-lab
Laboratorio de Regresión y Control CVE-2026-59891 Proyecto de laboratorio aislado y auditoría de solo lectura que compara las versiones vulnerable y corregida reales de @sigstore/oci con la misma entrada y comprueba las condiciones de exposición según el entorno. El CVE Reporter de este proyecto ...
CVE-2026-88887
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...
CVE-2026-88882
Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...
CVE-2026-88887 Renovate before 44.11.2 Credential Exfiltration via Link Header
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...
CVE-2026-72879 Dokploy: Command Injection via Registry Credentials in Swarm Upload
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...
EUVD-2026-55745
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...
CVE-2026-72879 Dokploy: Command Injection via Registry Credentials in Swarm Upload
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...
CVE-2026-72879
Summary: Dokploy before version 0.29.8 is affected by a command injection in getRegistryCommands() when building a shell command from registry.password and registry.registryUrl in packages/server/src/utils/cluster/upload.ts. An authenticated user with project access can supply malicious registry ...
CVE-2026-72736 Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a sa...
CVE-2026-72736 Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a sa...
CVE-2026-72736 Dokploy: OS Command Injection in registry credential testing and Swarm cluster management → HOST RCE
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a sa...
EUVD-2026-55684
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the registry credential testing and Docker Swarm cluster management endbpoints. Both endpoints have a sa...
GO-2026-5884 ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go
ORAS Go forwards registry credentials across registry redirects in oras.land/oras-go...
EUVD-2026-43960
Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry...
GHSA-PF56-329R-95RW Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
Impact This is a credential-exposure / credential-confusion issue. getRegistryCredentials reads credentials from the Docker config file /.docker/config.json and selects an entry by checking whether any configured auth key contains the target registry string: js Object.keysdockerConfig.auths ||...
Insufficiently Protected Credentials
Overview @sigstore/oci is an OCI artifact support Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getRegistryCredentials function. An attacker can obtain registry credentials by registering a malicious registry with a hostname that is a substring o...
CVE-2026-59891 Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring...