The vulnerability allows credentials used to access a registry to be sent to external blob stores during normal operation. This credential leakage can reveal authentication data to unintended parties, potentially allowing unauthorized access to protected resources. The weakness is classified as CWE-522, indicating improper handling of credentials.

The issue affects users of regclient, a Docker and OCI Registry Client written in Go, before version 0.11.5. All installations of regclient that interact with registries which do not restrict URLs for foreign blobs or which are controlled by malicious actors are vulnerable.

The CVSS score of 6.8 categorizes this as a medium severity flaw. Exploitation requires a malicious registry, blob store, or a registry that permits arbitrary external URLs, which may be hard to enforce. Because an EPSS score is not available, exploitation likelihood cannot be quantified; however, the flaw permits credential leakage that can be observed over the network. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation yet.