CVE-2026-24845
malcontent's OCI image scanning could expose registry credentials
Reported by github_m · Published January 29, 2026
malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcontent could be made to expose Docker registry credentials if it scanned a specially crafted OCI image reference. malcontent uses google/go-containerregistry for OCI image pulls, which by default uses the Docker credential keychain. A malicious registry could return a `WWW-Authenticate` header redirecting token authentication to an attacker-controlled endpoint, causing credentials to be sent to that endpoint. Version 1.20.3 fixes the issue by defaulting to anonymous auth for OCI pulls.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard-dev | malcontent | >= 0.10.0, < 1.20.3 |
| chainguard-dev | malcontent | 0.10.0 |
| github.com | chainguard-dev/malcontent | 0.10.0 |
Timeline
- Jan 29, 2026 CVE Published
- Jan 29, 2026 PoC Published
- Jan 30, 2026 EPSS Score (30 in total, the first dated here)
- Jan 30, 2026 CVE Updated
- Jan 30, 2026 Security Advisory
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-24845
vulnetix vdb fixes CVE-2026-24845Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-24845/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/chainguard-dev/malcontent/security/advisories/GHSA-9m43-p3cx-w8j5 x_refsource_CONFIRM
- https://github.com/chainguard-dev/malcontent/commit/538ed00cdc639d687a4bd1e843a2be0428a3b3e7 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-24845 advisory
- https://github.com/advisories/GHSA-9m43-p3cx-w8j5 advisory
- https://github.com/chainguard-dev/malcontent url