CVE-2026-65388
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0.
- Published Sep 16, 2026
- CVSS 7.5 high
- 0.4% chance of exploitation in the next 30 days (EPSS)
- A fix is available