Supply-Chain Compromise in Malcontent Docker Registry Credentials Exposure
CVE-2026-24845

6.5MEDIUM

Key Information:

Vendor

Chainguard-dev

Status
Malcontent
Vendor
CVE Published:
29 January 2026

What is CVE-2026-24845?

A vulnerability in Malcontent allows for exposure of Docker registry credentials when scanning specially crafted OCI image references. Versions 0.10.0 through 1.20.2 use the Docker credential keychain by default, potentially allowing malicious registries to redirect authentication tokens to unauthorized endpoints through a WWW-Authenticate header. This flaw enables attackers to intercept sensitive credential data. The issue is mitigated in version 1.20.3 which defaults to anonymous authentication for OCI pulls, reducing the risk of credential exposure.

Affected Version(s)

malcontent >= 0.10.0, < 1.20.3

References

https://github.com/chainguard-dev/malcontent/security/adv...
x_refsource_CONFIRM
https://github.com/chainguard-dev/malcontent/commit/538ed...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.