{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24845", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-27T14:51:03.059Z", "datePublished": "2026-01-29T21:02:24.371Z", "dateUpdated": "2026-01-29T21:40:17.926Z"}, "containers": {"cna": {"title": "malcontent's OCI image scanning could expose registry credentials", "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "lang": "en", "description": "CWE-522: Insufficiently Protected Credentials", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5"}, {"name": "https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7", "tags": ["x_refsource_MISC"], "url": "https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7"}], "affected": [{"vendor": "chainguard-dev", "product": "malcontent", "versions": [{"version": ">= 0.10.0, < 1.20.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T21:02:24.371Z"}, "descriptions": [{"lang": "en", "value": "malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a `WWW-Authenticate` header redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint. Version 1.20.3 fixes the issue by defaulting to anonymous auth for OCI pulls."}], "source": {"advisory": "GHSA-9m43-p3cx-w8j5", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T21:39:28.005129Z", "id": "CVE-2026-24845", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:40:17.926Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24845", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T21:39:28.005129Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:39:51.850Z"}}], "cna": {"title": "malcontent's OCI image scanning could expose registry credentials", "source": {"advisory": "GHSA-9m43-p3cx-w8j5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "chainguard-dev", "product": "malcontent", "versions": [{"status": "affected", "version": ">= 0.10.0, < 1.20.3"}]}], "references": [{"url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5", "name": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7", "name": "https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a `WWW-Authenticate` header redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint. Version 1.20.3 fixes the issue by defaulting to anonymous auth for OCI pulls."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T21:02:24.371Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24845", "state": "PUBLISHED", "dateUpdated": "2026-01-29T21:40:17.926Z", "dateReserved": "2026-01-27T14:51:03.059Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-29T21:02:24.371Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chainguard:malcontent:*:*:*:*:*:*:*:*", "matchCriteriaId": "B26FE904-C57A-4E90-AF6C-21261E98B0F8", "versionEndExcluding": "1.20.3", "versionStartIncluding": "0.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a `WWW-Authenticate` header redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint. Version 1.20.3 fixes the issue by defaulting to anonymous auth for OCI pulls."}], "id": "CVE-2026-24845", "lastModified": "2026-02-20T20:24:15.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-01-29T22:15:54.583", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:21:12.102871+00:00", "value": {"mitigation_remediation": ["Upgrade malcontent to version 1.20.3 or later to apply the default anonymous authentication change.", "If an upgrade is not immediately possible, configure malcontent to perform anonymous pulls or disable the use of the Docker credential keychain for OCI image requests.", "Enable logging and monitor for outbound authentication requests to external URLs, and block any unexpected token endpoints."], "summary": {"action": "Patch Immediately", "impact": "Credential Exposure"}, "threat_synthesis": {"affected_systems": "The product affected is Chainguard\u2011dev\u2019s malcontent. Versions starting at 0.10.0 and continuing through 1.20.2 are vulnerable, as they use default authentication. The fix is introduced in version 1.20.3, which defaults to anonymous pulls and therefore does not send credentials. No other vendors are listed.", "description_and_impact": "The vulnerability allows malcontent, a supply\u2011chain analysis tool, to send Docker registry credentials to an attacker\u2011controlled token endpoint during an OCI image scan. By using the default Docker credential keychain from google/go\u2011containerregistry, a malicious registry can include a WWW\u2011Authenticate header that redirects authentication to an external URL. When malcontent follows this redirect, the credentials it has stored for the registry are transmitted to the attacker, exposing them. This is a direct credential exposure flaw (CWE\u2011522) with no exploitation of code execution or privilege escalation.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate risk. The EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires the attacker to control or influence a registry\u2019s authentication response and supply a specially crafted OCI image reference to malcontent. Attackers with such access can obtain stored registry credentials, potentially granting further access to protected images or infrastructure."}}}}, "created": "2026-01-30T08:42:39.198877+00:00", "updated": "2026-04-18T01:30:16.035952+00:00", "vendors": ["chainguard-dev", "chainguard-dev$PRODUCT$malcontent"]}