# CVE-2026-65388: Apple Containerization registry credential disclosure in RegistryClient

Source: https://junglewise.ai/threats/cve-2026-65388-apple-containerization-registry-credential-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-65388 · Severity: high · CVSS 7.5 · Published 2026-09-16

Apple's Containerization library contains a vulnerability in how it validates token endpoints when communicating with container registries. A remote attacker controlling a registry can redirect credential requests to any host they choose, potentially exfiltrating authentication tokens and credentials. This could compromise access to internal services and private registries across an organization.

Vendors: [Apple](https://junglewise.ai/threats/vendors/apple).

## Quick answers

**Is CVE-2026-65388 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65388 being exploited in the wild.

**How severe is CVE-2026-65388?** High severity, with a CVSS score of 7.5, published 16 September 2026.

**Which products and versions are affected?** Apple Containerization <= 0.41.0.

**Is there a fix for CVE-2026-65388?** A patch was published on 2026-09-16: Fixed in version 0.41.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65388 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-65388?** Check whether you run Apple Containerization at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `RegistryClient` component's handling of HTTP 401/403 responses containing `WWW-Authenticate: Bearer` challenges. The client extracts the `realm` parameter from the challenge and uses it as a token endpoint URL without validating the host or scheme. An attacker controlling a container registry can supply a malicious realm value pointing to any network-accessible host, causing the client to send configured credentials to that destination. The attack requires only a client operation contacting the attacker's registry (including failed login attempts), and enables server-side request forgery (SSRF), token exfiltration from internal services, and cleartext credential exposure over HTTP. The vulnerability is fixed in version 0.41.0 and later.

## Affected products

- Apple Containerization <= 0.41.0

## Timeline

- 2026-08-30: disclosed
- 2026-09-16: patched: Fixed in version 0.41.0

## References

- [https://github.com/apple/containerization/security/advisories/GHSA-mx96-5vvg-x2mg](https://github.com/apple/containerization/security/advisories/GHSA-mx96-5vvg-x2mg)

## Related threats

- [Apple Container digest verification bypass in image pull](https://junglewise.ai/threats/cve-2026-113957-an-attacker-who-controls-the-registry-a-mirror-or-the-network)