CVE-2026-49349 regclient may leak authentication credentials to external blob stores
regclient may leak registry credentials to external servers when interacting with malicious registries or unrestricted blob stores.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-49349?
CVE-2026-49349 is a medium-severity vulnerability in regclient, published on 12 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue.
Weakness: CWE-522
Which versions are affected by CVE-2026-49349?
3 open source packages ship an affected version, including github.com/regclient/regclient.
| Package | Affected | Fixed in |
|---|---|---|
github.com/regclient/regclient Go | All versions | 0.11.5 |
github.com/regclient/regclient Go | All versions | 0.11.5 |
github.com/regclient/regclient Go | All versions | 0.11.5 |
How do I fix CVE-2026-49349?
Upgrade github.com/regclient/regclient to 0.11.5 or later.
Is CVE-2026-49349 being exploited?
There is no known exploitation of CVE-2026-49349 in the wild and no public exploit code.
Sources
Also known as GHSA-qvqc-4c52-x6qp, GO-2026-5822, MINI-2mxc-vg96-38hg, MINI-3rp9-ccjq-4v2r, MINI-cp6r-h56m-85wr, MINI-f284-3m5p-wm73 and 1 more.