CVE-2026-24845: 
NixOS vulnerability analysis and mitigation

CVE-2026-24845 is a credential exposure vulnerability in Chainguard's Malcontent, a supply-chain analysis tool, that can leak Docker registry credentials when scanning a specially crafted OCI image reference. It affects Malcontent versions 0.10.0 through 1.20.2 (prior to 1.20.3). The vulnerability was discovered by Oleh Konko from 1seal and disclosed on January 29, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Chainguard Advisory).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials). Malcontent uses the google/go-containerregistry library (crane package) for OCI image pulls, which by default invokes the Docker credential keychain for authentication. When a user scans an OCI image reference pointing to a malicious registry, that registry can return a crafted WWW-Authenticate HTTP response header that redirects token authentication requests to an attacker-controlled endpoint — a technique consistent with the Docker registry token authentication specification. Because Malcontent previously passed credentials from the local Docker keychain unconditionally during pulls, those credentials are forwarded to the attacker's endpoint. The fix (commit 538ed00) changes the default behavior to anonymous authentication (authn.Anonymous) for OCI pulls, with Docker keychain auth now opt-in via the new --oci-auth flag (Chainguard Advisory, Patch Commit).

Successful exploitation results in the exfiltration of Docker registry credentials stored in the victim's local Docker credential keychain to an attacker-controlled server. The confidentiality impact is high — stolen credentials could grant unauthorized access to private Docker or OCI registries, potentially exposing proprietary container images, secrets embedded in images, or enabling supply-chain attacks by pushing malicious images. There is no integrity or availability impact from the vulnerability itself, but secondary abuse of stolen credentials could be significant (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The attack requires user interaction — specifically, a user must be tricked into scanning a malicious OCI image reference with a vulnerable version of Malcontent. The EPSS score is approximately 0.034% (0.022% per Feedly), placing it in the 10th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Set up a malicious OCI registry: The attacker deploys a server that mimics an OCI-compliant container registry and also controls a separate token authentication endpoint (e.g., https://attacker.example.com/token).
2. Craft a malicious image reference: The attacker creates or advertises an OCI image reference pointing to their malicious registry (e.g., malicious-registry.example.com/fake-image:latest).
3. Lure the victim: The attacker tricks a user running a vulnerable version of Malcontent (0.10.0–1.20.2) into scanning the malicious image reference, for example by embedding it in a security report, issue, or documentation.
4. Trigger credential redirect: When Malcontent attempts to pull the image via crane.Pull(), the malicious registry responds with a WWW-Authenticate header specifying the attacker's endpoint as the token realm (e.g., Bearer realm="https://attacker.example.com/token").
5. Capture credentials: The google/go-containerregistry library, using the Docker credential keychain, sends the victim's Docker registry credentials (username/password or token) to the attacker's token endpoint, where they are logged and captured.
6. Abuse stolen credentials: The attacker uses the harvested credentials to authenticate to the victim's legitimate private Docker registries, enabling image exfiltration, tampering, or further supply-chain compromise (Chainguard Advisory, Patch Commit).

• Network: Unexpected outbound HTTPS requests from the host running Malcontent to unfamiliar or external token authentication endpoints (non-standard registry domains) during OCI image scan operations; DNS queries for attacker-controlled domains coinciding with malcontent scan activity.
• Logs: System or application logs showing Malcontent (mal) invocations with --oci flag targeting external or unfamiliar image references; HTTP client logs (if enabled) showing WWW-Authenticate bearer token requests to unexpected hosts.
• Process: Malcontent process (mal) making outbound network connections to hosts other than the intended OCI registry during a scan — observable via tools like netstat, ss, or EDR process network telemetry.
• Credential Stores: Unexpected authentication events or access attempts on private Docker registries (e.g., Docker Hub, GHCR, ECR) from unfamiliar IP addresses shortly after a Malcontent scan was performed.

Upgrade Malcontent to version 1.20.3 or later, which defaults to anonymous authentication for all OCI image pulls, preventing credential leakage via malicious WWW-Authenticate redirects. Users who require authenticated pulls from trusted private registries must now explicitly pass the --oci-auth flag, which re-enables Docker keychain authentication with an explicit warning about the credential exposure risk. As an interim measure for users unable to upgrade, avoid scanning OCI image references from untrusted or unknown registries. Additionally, review Docker credential keychain contents and rotate any credentials that may have been exposed if vulnerable versions were used to scan external image references (Chainguard Advisory, Patch Commit).

The vulnerability was credited to Oleh Konko from 1seal for responsible disclosure, with remediation developed by the Chainguard team (egibs, antitree, stevebeattie, eslerm). The advisory was published on January 29, 2026, and the fix was merged promptly. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified (Chainguard Advisory).