regclient: registry credentials can leak to an attacker-controlled blob host via foreign blob URLs

Impact

regclient can be induced to send registry credentials to an external server when a registry hands it a foreign blob pointing at a URL the operator does not control. The prerequisite is a malicious registry, a malicious blob store, or a registry that does not restrict foreign blob URLs - which makes this a risk for anyone whose mirroring or promotion tooling pulls from third-party registries. On a GPU fleet, regclient typically runs in CI or in an image-mirroring job holding push credentials for the internal registry that every node pulls from, so a leaked credential is a path to publishing a modified CUDA or inference image that lands on many nodes at once. Nothing is compromised on the GPU nodes themselves; the exposure is the registry credential and what it can push.

Who can reach it

Requires that regclient be pointed at a registry or blob store the attacker controls or has influenced, with the operator's credentials configured. Authenticated to the victim registry as the tool normally is; the attacker needs no access to the operator's environment.

What to do

Upgrade regclient to 0.11.5 or later, and rebuild anything that vendors it as a Go library - a package upgrade alone does not fix a statically linked copy in a CI image. Rotate any registry credentials that have been used against third-party registries with this tool, since a leak would be silent.

References

Related entries

• containerd: CRI ExecSync I/O drain never times out, leaking goroutines until the OOM killer takes the runtimeCVE-2026-53495 · containerd CRI plugin (ExecSync I/O drain in container_execsync.go)Medium
• Distribution: digest-pinned manifest pulls are not verified, so a registry can substitute contentCVE-2026-85747 · CNCF Distribution registry client and pull-through proxy cache (manifest digest verification)Medium
• Warpgate: Kubernetes correlation entries keyed by username survive account deletion, bypassing target authorizationCVE-2026-91168 · Warpgate Kubernetes request correlator (warpgate-protocol-kubernetes/src/correlator.rs)Medium
• BuildKit: oversized Dockerfile or .dockerignore exhausts buildkitd memory and kills concurrent buildsCVE-2026-93323 · BuildKit Dockerfile frontend (Dockerfile/.dockerignore size limit)Medium
• Kubernetes (kube-apiserver): A node can delete itself, and cascade-delete other objects, by adding an OwnerReferenceCVE-2025-5187 · Kubernetes (kube-apiserver)Medium
• Docker Sandboxes: case-variant OAuth hostname bypasses credential masking, leaking host tokensCVE-2026-105570 · Docker Sandboxes (OAuth token-endpoint hostname matching for managed credential injection)Medium