{"id":"CVE-2026-49349","title":"regclient is a Docker and OCI Registry Client in Go","summary":"regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob sto…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","cwe":["CWE-522"],"vendor":"regclient","product":"github.com/regclient/regclient","affected":["github.com/regclient/regclient <= 0.11.4"],"patched":["github.com/regclient/regclient 0.11.5"],"published":"2026-08-12","updated":"2026-09-09","sourceUpdated":"2026-09-09T20:55:04.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49349","references":[{"url":"https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-qvqc-4c52-x6qp"}],"tags":["nvd","ghsa","go"],"epss":0.0022,"epssPercentile":0.12692,"ecosystem":"go","ingestedAt":"2026-06-29T13:24:35.092Z","slug":"CVE-2026-49349","body":"## Overview\n\nregclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49349)\n\nAffected packages:\n\n- `github.com/regclient/regclient <= 0.11.4`\n\nPatched in:\n\n- `github.com/regclient/regclient 0.11.5`\n\nSource: https://github.com/advisories/GHSA-qvqc-4c52-x6qp","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}