Ghostwire

CVE-2026-28909: Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry...

CRITICAL CVSS 9.5

Published: April 30, 2026 | Last Modified: April 30, 2026

Description

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.

Ghostwire Analysis — What This Means Practically

Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Security Coverage (2 articles)

References

www.tenable.com/cve/CVE-2026-28909
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-28909