CVE-2026-24845

描述

Malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. Malcontent uses [google/go-containerregistry](https://github.com/google/go-containerregistry) for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a `WWW-Authenticate` header redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint. **Fix:** [Default to anonymous auth for OCI pulls](https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7) **Acknowledgements** Thank you to Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.

受影響套件(3)

• Go/github.com/chainguard-dev/bincapz>= 0.10.0
• Go/github.com/chainguard-dev/malcontent>= 0.10.0, < 1.20.3
• Go/github.com/chainguard-dev/malcontentfrom 0, < 1.20.3

CVSS 分數

參考連結(4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-24845
• PATCHhttps://github.com/chainguard-dev/malcontent
• WEBhttps://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7
• WEBhttps://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5