Users who connect to malicious registries whose hostnames match certain bypass patterns will have their registry credentials exposed in plaintext. This flaw allows an attacker to obtain sensitive authentication information simply by directing a user to a registry that satisfies those patterns. The likely attack vector is the use of a malicious or compromised registry that mimics known bypass hostnames, causing the container client to convey credentials without encryption or proper validation.

Apple macOS containers older than version 0.12.3 are affected. The issue is resolved in container 0.12.3; therefore any deployment running an earlier version of the Apple Container on macOS could be compromised if it connects to a registry that triggers the bypass rule.

Because the exported credentials appear in plaintext, a malicious registry can capture and reuse them for unauthorized access to other resources. The CVSS score of 6.5 indicates a medium to high risk level. The EPSS score is less than 1%, suggesting that exploitation is currently unlikely but not impossible. The vulnerability is not listed in CISA's KEV catalog, but the potential for credential theft remains high due to the ease of providing a hostname that matches the bypass pattern.