---
id: GO-2026-6225
title: >-
  Credential leakage to untrusted hosts in
  github.com/chrismellard/docker-credential-acr-env
summary: >-
  Credential leakage to untrusted hosts in
  github.com/chrismellard/docker-credential-acr-env
severity: none
vendor: chrismellard
product: github.com/chrismellard/docker-credential-acr-env
ecosystem: go
affected:
  - github.com/chrismellard/docker-credential-acr-env
published: '2026-08-18'
updated: '2026-08-19'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6225'
references:
  - url: 'https://github.com/chrismellard/docker-credential-acr-env/issues/21'
  - url: 'https://github.com/osscontainertools/docker-credential-acr'
tags:
  - osv
  - go
ingestedAt: '2026-08-19T19:22:26.784Z'
---

## Overview

In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.

## Affected packages

- `github.com/chrismellard/docker-credential-acr-env`

## Remediation

Refer to the advisory for the patched release.