CVE-2026-65388High· 7.5▾ TwilightA remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in contai…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 7.5
none → high
Last analysed / modified upstream
0.3%
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84624Medium· 5.5A permissions issue was addressed with improved path validation
CVE-2026-84576Medium· 5.5This issue was addressed with improved checks
CVE-2026-84632High· 7.3The issue was addressed with improved memory handling
CVE-2026-84560Medium· 6.1An authorization issue was addressed with improved state management
CVE-2026-84583Medium· 5.5A permissions issue was addressed with additional restrictions
CVE-2026-84612Medium· 5.5An authorization issue was addressed with improved access control