CVE-2026-28909
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext.
Published Apr 30, 2026 · updated Jun 17, 2026 · apple container
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 30, 2026 · NIST NVD
Detected
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.
Jun 17, 2026 · NIST NVD
Updated
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.
Affected
- cpe apple/containerversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-28909
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-28909
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.
nvd.nist.gov