CVE-2026-28909

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/apple/container/security/advisories/GHSA-m5rp-xcpf-r8m7	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apple:container:*:*:*:*:*:swift:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Usuarios que se conectan a registros maliciosos con nombres de host que coinciden con los patrones de omisión verán expuestas sus credenciales de registro en texto plano. Este problema está solucionado en la versión del contenedor 0.12.3.

Information

Published : 2026-04-30 23:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-28909

Mitre link : CVE-2026-28909

CVE.ORG link : CVE-2026-28909

JSON object : View

Products Affected

apple

container

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-28909", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28909", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T13:56:29.585092Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "product-security@apple.com", "affectedData": [{"vendor": "Apple", "product": "macOS", "versions": [{"status": "affected", "version": "0.12.1", "lessThan": "0.12.3", "versionType": "custom"}]}]}], "published": "2026-04-30T23:16:20.437", "references": [{"url": "https://github.com/apple/container/security/advisories/GHSA-m5rp-xcpf-r8m7", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3."}, {"lang": "es", "value": "Usuarios que se conectan a registros maliciosos con nombres de host que coinciden con los patrones de omisi\u00f3n ver\u00e1n expuestas sus credenciales de registro en texto plano. Este problema est\u00e1 solucionado en la versi\u00f3n del contenedor 0.12.3."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apple:container:*:*:*:*:*:swift:*:*", "vulnerable": true, "matchCriteriaId": "1C067E9C-6452-4283-9983-6662D48D5A83", "versionEndExcluding": "0.12.3"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}