GHSA-qhh4-458h-xwh2: Credential Leakage via Origin Validation Error in cdxgen

Vulnerability ID: GHSA-QHH4-458H-XWH2

CVSS Score: 5.3

Published: 2026-05-08

The @cyclonedx/cdxgen package is vulnerable to credential leakage due to improper Docker registry origin validation. A flaw in how registry authentication endpoints are matched against configured credentials allows arbitrary downstream registries to capture private credentials.

TL;DR

Versions 9.9.5 through 12.3.2 of @cyclonedx/cdxgen leak Docker registry credentials due to an insecure substring matching implementation.…