CVE Explorer

CVE-2026-24845

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a `WWW-Authenticate` header redirecting token authentication to an attacker-

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:58b960a6ec709e45b3992d5fc91919eb94369e590058f5e91f41a84bb35abb77

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"malcontent","vendor":"chainguard-dev","versions":[{"status":"affected","version":">= 0.10.0, < 1.20.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:8934d2b7dca4ea1bd14f80c967b519a6644f0fad59461a19d01102b42edfd09a · sha256:2720623c190e9573… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:8934d2b7dca4ea1bd14f80c967b519a6644f0fad59461a19d01102b42edfd09a · sha256:2720623c190e9573… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-522","description":"CWE-522: Insufficiently Protected Credentials","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:8934d2b7dca4ea1bd14f80c967b519a6644f0fad59461a19d01102b42edfd09a · sha256:2720623c190e9573… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7","tags":["x_refsource_MISC"],"url":"https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8934d2b7dca4ea1bd14f80c967b519a6644f0fad59461a19d01102b42edfd09a · sha256:2720623c190e9573… · /containers/cna/references/1

{"name":"https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5","tags":["x_refsource_CONFIRM"],"url":"https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:8934d2b7dca4ea1bd14f80c967b519a6644f0fad59461a19d01102b42edfd09a · sha256:2720623c190e9573… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer