CVE-2026-12566

Name of the Vulnerable Software and Affected Versions bbot (affected versions not specified)

Description The docker pull module fails to validate the realm parameter received from a Docker registry's WWW-Authenticate response header when using it as the authentication endpoint. A man-in-the-middle attacker positioned between bbot and a Docker registry could modify this header to redirect authentication requests to an arbitrary endpoint, which may lead to the leakage of authentication tokens.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.