CyberRota Analysis
AI-GeneratedDocker's regclient, prior to version 0.11.5, has a vulnerability that could lead to the unintended leakage of registry credentials to external servers when interacting with malicious registry servers or blob stores. This poses a risk of credential exposure, which could be exploited by attackers to gain unauthorized access to resources. Organizations using affected versions of regclient should prioritize upgrading to version 0.11.5 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.