Description
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.
Affected products
apple: container
References1
- github.com/apple/container/security/advisories/GHSA-m5rp-xcpf-r… Vendor Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 10 · as of 13 November 2026
- CWE
- CWE-522
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.