CVE-2026-49349

Name of the Vulnerable Software and Affected Versions regclient (affected versions not specified)

Description Authentication credentials for a registry may be leaked to external servers. This occurs when a malicious registry server, a malicious blob store, or a registry that fails to restrict external URLs for foreign blobs is used. If an OCI image manifest contains a layer descriptor with a urls field pointing to an attacker-controlled host, and the primary blob request to the registry fails, the software falls back to these external URLs. If the external server requests authentication, the credentials for the original registry server are sent to the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.