CVE-2026-65388 Overview
CVE-2026-65388 affects Apple's containerization framework, an open-source Swift package for running Linux containers on macOS. A remote attacker who controls a container registry can redirect a client's authentication token request to an arbitrary host. This redirection causes the victim's registry credentials to be transmitted to a location chosen by the attacker. The flaw enables credential theft against any client that pulls images from a malicious or compromised registry. The issue is fixed in containerization version 0.41.0. Details are published in the GitHub Security Advisory GHSA-mx96-5vvg-x2mg.
Critical Impact
Attacker-controlled registries can harvest victim registry credentials by redirecting token authentication requests to arbitrary hosts.
Affected Products
- Apple containerization framework prior to version 0.41.0
- macOS environments consuming the containerization Swift package for Linux container workloads
- Downstream tools and CI pipelines that authenticate to container registries through the affected library
Discovery Timeline
- 2026-09-16 - CVE-2026-65388 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-65388
Vulnerability Analysis
The vulnerability resides in how the containerization client handles the OAuth2-style token exchange defined by the Distribution Registry specification. When a registry responds to an unauthenticated request with a WWW-Authenticate: Bearer challenge, the client parses the realm parameter and sends its credentials to that URL to obtain a bearer token. In the affected versions, the client trusts the realm value without validating that it points to the same host as the original registry request. A malicious registry can therefore supply a realm pointing to any attacker-controlled endpoint. The client then transmits the victim's registry username and password directly to the attacker. Because container tooling often stores long-lived credentials for registries such as Docker Hub, GitHub Container Registry, or private enterprise registries, the disclosed material can be reused for supply chain compromise.
Root Cause
The root cause is missing validation of the authentication endpoint returned in the registry's challenge response. The client treats the realm URL as trusted metadata rather than untrusted input, resulting in an Information Exposure condition tied to insufficient origin checking during the token exchange flow.
Attack Vector
An attacker must operate a container registry or compromise one that a victim already trusts. When the victim's client pulls or pushes an image, the attacker responds with a crafted WWW-Authenticate header whose realm points to attacker-controlled infrastructure. The client then performs a Basic authentication request to that host, disclosing the credentials configured for the original registry hostname.
No verified proof-of-concept code is published. See the GitHub Security Advisory for the maintainer's technical description.
Detection Methods for CVE-2026-65388
Indicators of Compromise
- Outbound HTTPS requests from developer workstations or build agents to unfamiliar hosts immediately following container registry interactions.
- WWW-Authenticate responses from registries where the realm parameter references a domain that does not match the registry hostname.
- Unexpected use of registry credentials from IP addresses or ASNs not associated with the legitimate registry provider.
Detection Strategies
- Inspect proxy and TLS inspection logs for token requests sent to hosts distinct from the registry originally contacted by the container client.
- Correlate containerization process activity on macOS hosts with outbound network connections to identify anomalous token endpoints.
- Alert on registry authentication events originating outside expected network ranges by ingesting registry access logs into a SIEM.
Monitoring Recommendations
- Enable audit logging on all container registries and monitor for authentication attempts from previously unseen source addresses.
- Track the version of the containerization package deployed across macOS build and developer fleets to identify unpatched instances.
- Watch for image pulls from newly added or untrusted registry hostnames in developer and CI environments.
How to Mitigate CVE-2026-65388
Immediate Actions Required
- Upgrade the containerization package to version 0.41.0 or later across all macOS hosts and build systems.
- Rotate any registry credentials that may have been used with vulnerable clients when pulling from untrusted or third-party registries.
- Restrict container clients to a curated allowlist of registry hostnames enforced at the network or proxy layer.
Patch Information
The maintainers addressed the vulnerability in containerization version 0.41.0. Refer to the GitHub Security Advisory GHSA-mx96-5vvg-x2mg for release notes and the corresponding source changes.
Workarounds
- Avoid pulling images from registries that are not explicitly trusted until the client is upgraded.
- Use short-lived registry tokens or scoped credentials instead of long-lived username and password pairs.
- Route registry traffic through an egress proxy that enforces that token requests remain on the original registry origin.
# Verify the installed containerization package version
swift package show-dependencies | grep -i containerization
# Pin the fixed version in Package.swift
# .package(url: "https://github.com/apple/containerization", from: "0.41.0")
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
