Executive brief
cdxgen is a tool used to generate software bill-of-materials (BOM) documents for container images by scanning them through Docker. A flaw in its credential handling logic causes it to forward authentication credentials for one private container registry to a different registry when the registries' hostnames have a substring match. This allows attackers who control a registry matching part of a victim's private registry hostname to steal the victim's Docker credentials.
Technical details
cdxgen contains an origin-unsafe registry credential matching vulnerability in lib/managers/docker.js that uses substring matching instead of strict hostname comparison. When selecting Docker credentials from config.json for an image pull request, the code checks if serverAddress.includes(forRegistry), which incorrectly matches "private-registry.example.com" when requesting "registry.example.com". The matched credentials are then serialized into the X-Registry-Auth header and sent to the Docker daemon API for the wrong registry. Attack requires the victim to scan an image from a registry whose hostname is a substring of their private registry hostname; no special privileges or authentication are needed. The fix (available in v12.3.3 and PR #3964) replaces substring matching with normalizeRegistryHost and registriesMatch functions for strict hostname comparison. Affected versions: >=9.9.5 through 12.3.2.
Affected products
- CycloneDX cdxgen >=9.9.5 through 12.3.2
Timeline
- 2026-05-08: disclosed
- 2026-05-08: patched: Fixed in version 12.3.3 (PR #3964)