What’s Vulnerable › Vulnerabilities
CVE-2026-65388
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-18
- Weakness: CWE-601
Description
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0.
Affected products
- Apple Containerization: before 0.41.0 — fixed in 0.41.0
How to fix
Upgrade to a fixed version: Apple Containerization 0.41.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-65388 or the next vulnerability affects your stack