Medium · 6.5 CVE-2026-28909 EUVD-2026-26452

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plain…

Published Apr 30, 2026 · Updated May 1, 2026 · Assigned by apple

Vendor: Apple Product: macOS Platform: macOS

Description

Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.

Affected products

Vendor	Product	Affected	Fixed
Apple	macOS	0.12.1 – < 0.12.3	0.12.3

References

https://github.com/apple/container/security/advisories/GHSA-m5rp-xcpf-r8m7