GO-2026-5822 regclient may leak authentication credentials to external blob stores in github.com/regclient/regclient

regclient may leak authentication credentials to external blob stores in github.com/regclient/regclient...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the urls field in the layer descriptor. An attacker can obtain authentication credentials by serving a manifest with a urls entry pointing to an attacker-controlled host and causing the client to...

regclient may leak authentication credentials to external blob stores

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Example attack A malicious registry serves an OCI image...

regclient-0.11.4-1.1 on GA media (moderate)

regclient-0.11.4-1.1 on GA media Announcement ID: openSUSE-SU-2026:10763-1 Rating: moderate Cross-References: CVE-2026-33814 CVSS scores: CVE-2026-33814 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now b...

OPENSUSE-SU-2026:10763-1 regclient-0.11.4-1.1 on GA media

These are all security issues fixed in the regclient-0.11.4-1.1 package on the GA media of openSUSE Tumbleweed...

regclient-0.11.2-1.1 on GA media (moderate)

regclient-0.11.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10256-1 Rating: moderate Cross-References: CVE-2025-68121 CVSS scores: CVE-2025-68121 SUSE : 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVE-2025-68121 SUSE : 7.6 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:...

OPENSUSE-SU-2026:10256-1 regclient-0.11.2-1.1 on GA media

These are all security issues fixed in the regclient-0.11.2-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:15807-1 regclient-0.11.1-1.1 on GA media

These are all security issues fixed in the regclient-0.11.1-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: helm-operator, harbor-scanner-trivy, spicedb-operator, mkcert, runc, terraform-provider-azuread, secrets-store-csi-driver, nri-kafka, thanos-operator, regclient, infinispan-operator, src, spqr, terraform-provider-google, nri-apache, kubelet-csr-approver,...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: helm-operator, harbor-scanner-trivy, spicedb-operator, mkcert, runc, terraform-provider-azuread, secrets-store-csi-driver, nri-kafka, thanos-operator, regclient, infinispan-operator, src, spqr, terraform-provider-google, nri-apache, kubelet-csr-approver,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: aws-iam-authenticator-fips, mesosphere-vsphere-csi, opa-fips-envoy, boring-registry-fips, opa-fips, k6-operator-fips, cloud-provider-aws-fips, policy-controller, aws-flb-firehose-fips, dragonfly-operator-fips, spicedb-operator, prometheus-mysqld-exporter-fips,...

regclient-0.10.0-1.1 on GA media (moderate)

regclient-0.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15723-1 Rating: moderate Cross-References: CVE-2025-47912 CVE-2025-58183 CVE-2025-58185 CVE-2025-58186 CVE-2025-58187 CVE-2025-58188 CVE-2025-58189 CVE-2025-61723 CVE-2025-9230 CVE-2025-9231 CVE-2025-9232 CVSS scores: CVE-2025-479...

OPENSUSE-SU-2025:15723-1 regclient-0.10.0-1.1 on GA media

These are all security issues fixed in the regclient-0.10.0-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, helm-operator, glow, amazon-cloudwatch-agent-operator, cilium-cli, kapp-controller, thanos-operator, regclient, libnvidia-container, grafana-alloy, src, wait-for-port, nri-apache, nri-rabbitmq, kind, chartmuseum,...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: node-problem-detector, dapr, rancher, knative-serving, harbor-cli, kubernetes-csi-external-health-monitor, cert-manager, kubeflow-katib, prometheus-operator, envconsul, nri-memcached, buildkitd, kubernetes-csi-driver-nfs, render-template, helm-operator, guac,...

OPENSUSE-SU-2025:15515-1 regclient-0.9.2-1.1 on GA media

These are all security issues fixed in the regclient-0.9.2-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2025-24882

regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1...

CVE-2025-24882

regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1...

CVE-2025-24882 regclient may ignore pinned manifest digests

regclient is a Docker and OCI Registry Client in Go. A malicious registry could return a different digest for a pinned manifest without detection. This vulnerability is fixed in 0.7.1...

CVE-2025-24882

In regclient (Go), a vulnerability exists where a malicious registry could return a different digest for a pinned manifest without detection. This is addressed by upgrading to version 0.7.1 (fixed in 0.7.1). Affected: regclient’s Docker/OCI registry client functionality; root cause details are th...