—
GO-2026-6225
Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env
Details
In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/chrismellard/docker-credential-acr-env
Introduced in:
0 No fixed version published yet for github.com/chrismellard/docker-credential-acr-env (go modules). Pin to a known-safe version or switch to an alternative.