GHSA-qhh4-458h-xwh2 @cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

Not scored Published 8 May 2026

An attacker can steal Docker registry credentials by exploiting substring matching logic that forwards private registry credentials to unrelated public registries.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-qhh4-458h-xwh2?

GHSA-qhh4-458h-xwh2 is a vulnerability in @cyclonedx/cdxgen, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Docker registry auth substring match forwards credentials to a different registry

Repository

cdxgen/cdxgen

Affected product/package

Ecosystem: npm
Package: @cyclonedx/cdxgen
Reviewed tree version: 12.3.3
Reviewed commit: b1e179869fd7c6032c3d483c3f7bd4d7154ec22b
Affected file: lib/managers/docker.js
Affected from: v9.9.5

The Single Executable Applications (SEA) binaries and container images are also affected.

Weakness

CWE-522 / CWE-346.

Summary

When cdxgen scans or pulls container images through the Docker daemon API, it builds an X-Registry-Auth header from Docker credentials in DOCKER_CONFIG/config.json. The credential selection logic matches configured registry keys with substring checks:

if (forRegistry &amp;&amp; !serverAddress.includes(forRegistry)) {
  continue;
}

This is not an origin-safe registry comparison. For example, credentials configured for private-registry.example.com are selected for a requested image under registry.example.com, because:

&#34;private-registry.example.com&#34;.includes(&#34;registry.example.com&#34;) === true

The selected credentials are then serialized into X-Registry-Auth for the Docker API pull request targeting the requested registry.

Reproduction

Use the attached/local proof:

node submissions/github-gsa/cdxgen-docker-registry-auth-substring-forwarding/evidence/cdxgen_docker_registry_auth_substring_probe.mjs

The proof is fully local. It creates a temporary Docker config containing credentials for private-registry.example.com, starts a localhost mock Docker API endpoint, sets DOCKER_HOST to that endpoint, then calls cdxgen's exported Docker request path for a pull from registry.example.com.

Observed vulnerable output:

{
  &#34;decision&#34;: &#34;GO&#34;,
  &#34;dockerConfigAuthHost&#34;: &#34;private-registry.example.com&#34;,
  &#34;requestedRegistry&#34;: &#34;registry.example.com&#34;,
  &#34;substringMatch&#34;: true,
  &#34;dockerApiUrl&#34;: &#34;/images/create?fromImage=registry.example.com/team/app:latest&#34;,
  &#34;headerPresent&#34;: true,
  &#34;decodedHeader&#34;: {
    &#34;username&#34;: &#34;trusted-user&#34;,
    &#34;password&#34;: &#34;trusted-pass&#34;,
    &#34;serveraddress&#34;: &#34;private-registry.example.com&#34;
  }
}

Impact

If an operator has Docker credentials for a private registry and uses cdxgen to scan an image from a different registry whose hostname is a substring of that private registry hostname, cdxgen can attach the private registry credentials to the Docker pull request for the different registry.

In a realistic attack, an attacker who controls or can observe the requested registry can induce a victim to scan an image from that registry. The Docker daemon API receives an X-Registry-Auth payload containing credentials for the victim's private registry but associated with the attacker-requested pull. This is a credential forwarding/misbinding issue in cdxgen's container image handling.

References

Functions normalizeRegistryHost and registriesMatch added to normalize and perform strict host matching.

Fix PR: https://github.com/cdxgen/cdxgen/pull/3964

Researcher: Francesco SabiuResearcher: Francesco Sabiu

Which versions are affected by GHSA-qhh4-458h-xwh2?

2 open source packages ship an affected version, including @cyclonedx/cdxgen.

Package	Affected	Fixed in
`@cyclonedx/cdxgen` npm	From `9.9.5`	`12.3.3`
`@cyclonedx/cdxgen` npm	From `9.9.5`	`12.3.3`

How do I fix GHSA-qhh4-458h-xwh2?

Upgrade @cyclonedx/cdxgen to 12.3.3 or later.

Is GHSA-qhh4-458h-xwh2 being exploited?

There is no known exploitation of GHSA-qhh4-458h-xwh2 in the wild and no public exploit code.