—
GO-2026-6225
Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env
상세
In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
Go / github.com/chrismellard/docker-credential-acr-env
최초 영향 버전:
0 No fixed version published yet for github.com/chrismellard/docker-credential-acr-env (go modules). Pin to a known-safe version or switch to an alternative.