PT-2026-36209 · Unknown · Containers

Hackerman70000 · CVE-2026-28909 · Published 2026-04-30 · Updated 2026-05-01

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions container versions prior to 0.12.3

Description Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext.

Recommendations Update to version 0.12.3.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-28909

GHSA-M5RP-XCPF-R8M7

Affected Products

Containers

References · 7

• https://github.com/apple/container/security/advisories/GHSA-m5rp-xcpf-r8m7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-28909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28909 · Security Note
• https://twitter.com/CVEnew/status/2049984034244276571 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049984837436551503 · Twitter Post
• https://t.me/cveNotify/161727 · Telegram Post
• https://t.me/CVEtracker/52369 · Telegram Post