regclient: registry credentials can leak to an attacker-controlled blob host via foreign blob URLs

Impact

regclient can be induced to send registry credentials to an external server when a registry hands it a foreign blob pointing at a URL the operator does not control. The prerequisite is a malicious registry, a malicious blob store, or a registry that does not restrict foreign blob URLs - which makes this a risk for anyone whose mirroring or promotion tooling pulls from third-party registries. On a GPU fleet, regclient typically runs in CI or in an image-mirroring job holding push credentials for the internal registry that every node pulls from, so a leaked credential is a path to publishing a modified CUDA or inference image that lands on many nodes at once. Nothing is compromised on the GPU nodes themselves; the exposure is the registry credential and what it can push.

Who can reach it

Requires that regclient be pointed at a registry or blob store the attacker controls or has influenced, with the operator's credentials configured. Authenticated to the victim registry as the tool normally is; the attacker needs no access to the operator's environment.

What to do

Upgrade regclient to 0.11.5 or later, and rebuild anything that vendors it as a Go library - a package upgrade alone does not fix a statically linked copy in a CI image. Rotate any registry credentials that have been used against third-party registries with this tool, since a leak would be silent.

References

Related entries

• Kubernetes (kube-apiserver): A node can delete itself, and cascade-delete other objects, by adding an OwnerReferenceCVE-2025-5187 · Kubernetes (kube-apiserver)Medium
• JFrog Artifactory Helm chart: generated TLS private keys retained in rendered manifestsCVE-2026-66016 · JFrog Artifactory self-hosted Helm deployment (generated TLS private keys)Medium
• Kubernetes (kube-apiserver): Node address not verified when proxyingCVE-2022-3294 · Kubernetes (kube-apiserver)Medium
• Argo CD (Helm OCI repository credential logging): CREDENTIAL DISCLOSURE THROUGH THE LOG PIPELINE: Argo CD wrote theNCVD-2021-016-argo-cd-helm-oci-repository-cred · Argo CD (Helm OCI repository credential logging)Medium
• Helm: Path traversal in `helm fetch --untar` writes outside the target directoryCVE-2019-1000008 · HelmMedium
• Kubernetes (kubectl): `kubectl cp` path traversal from a malicious container tar overwrites files on the operator'sCVE-2019-11246 · Kubernetes (kubectl)Medium