CVE-2026-65388

A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0.

Score

CVSS 3.1 7.5 High

Status

Awaiting Analysis - product-security@apple.com

Published

2026-09-16

Last modified

2026-09-17

Weaknesses

CWE-601

Affected products

• Containerization (Apple)

References

• https://github.com/apple/containerization/security/advisories/GHSA-mx96-5vvg-x2mg