Is CVE-2026-12566 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12566 being exploited in the wild.

How severe is CVE-2026-12566?

Low severity, with a CVSS score of 3.1, published 17 June 2026.

Which products and versions are affected?

bbot (PyPI) >= 2.0.0, <= 2.8.4, ECOSYSTEM:introduced=2.0.0,fixed=2.8.5.

Is there a fix for CVE-2026-12566?

Yes. bbot (PyPI): upgrade to 2.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12566 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-12566?

Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12566: Black Lantern Security BBOT SSRF in docker_pull module

Q: Is there a fix for CVE-2026-12566?

Yes. bbot (PyPI): upgrade to 2.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-12566 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-12566?

Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12566 · Severity: low · CVSS 3.1 · Published 2026-06-17

A vulnerability in the BBOT security tool's Docker integration could allow an attacker to intercept sensitive login credentials. By sitting between the tool and a Docker registry, an attacker can redirect authentication requests to a server they control. This could lead to the theft of authentication tokens used to access private container images.

Technologies: bbot (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-12566 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12566 being exploited in the wild.
How severe is CVE-2026-12566?: Low severity, with a CVSS score of 3.1, published 17 June 2026.
Which products and versions are affected?: bbot (PyPI) >= 2.0.0, <= 2.8.4, ECOSYSTEM:introduced=2.0.0,fixed=2.8.5.
Is there a fix for CVE-2026-12566?: Yes. bbot (PyPI): upgrade to 2.8.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12566 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-12566?: Check whether you run bbot (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

bbot (PyPI): upgrade to 2.8.5 or later
```
pip install "bbot>=2.8.5"
```

Technical details

The docker_pull module in BBOT (up to version 2.8.4) is vulnerable to a form of Server-Side Request Forgery (SSRF) and credential leakage. When connecting to a Docker registry, the module uses the 'realm' parameter from the WWW-Authenticate response header as the authentication endpoint without proper validation. A man-in-the-middle (MitM) attacker can modify this header to point to a malicious endpoint. If the tool then attempts to authenticate against this rogue endpoint, it may leak sensitive authentication tokens to the attacker. A fix has been identified in commit c2f4bc0.

Affected products

Black Lantern Security BBOT 2.0.0 to 2.8.4

Identifiers

CVE-2026-12566
GHSA-3mp7-vp6j-2mxx
PYSEC-2026-2391

Timeline

2026-06-17: disclosed
2026-06-17: advisory

References

https://github.com/blacklanternsecurity/bbot/commit/c2f4bc0f4

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.