Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4, published 8 May 2026.

Which products and versions are affected?

CycloneDX Cdxgen >=9.9.5 through 12.3.2; @cyclonedx/cdxgen (npm) SEMVER:introduced=9.9.5,fixed=12.3.3.

Is there a fix for This vulnerability?

Yes. @cyclonedx/cdxgen (npm): upgrade to 12.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run CycloneDX Cdxgen or @cyclonedx/cdxgen (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CycloneDX cdxgen Docker registry auth substring match credential forwarding

Severity: medium · CVSS 4 · Published 2026-05-08

cdxgen is a tool used to generate software bill-of-materials (BOM) documents for container images by scanning them through Docker. A flaw in its credential handling logic causes it to forward authentication credentials for one private container registry to a different registry when the registries' hostnames have a substring match. This allows attackers who control a registry matching part of a victim's private registry hostname to steal the victim's Docker credentials.

Technologies: CycloneDX Cdxgen, @cyclonedx/cdxgen (npm). Vendors: CycloneDX, npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4, published 8 May 2026.
Which products and versions are affected?: CycloneDX Cdxgen >=9.9.5 through 12.3.2; @cyclonedx/cdxgen (npm) SEMVER:introduced=9.9.5,fixed=12.3.3.
Is there a fix for This vulnerability?: Yes. @cyclonedx/cdxgen (npm): upgrade to 12.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run CycloneDX Cdxgen or @cyclonedx/cdxgen (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@cyclonedx/cdxgen (npm): upgrade to 12.3.3 or later
```
npm install @cyclonedx/cdxgen@12.3.3
```

Technical details

cdxgen contains an origin-unsafe registry credential matching vulnerability in lib/managers/docker.js that uses substring matching instead of strict hostname comparison. When selecting Docker credentials from config.json for an image pull request, the code checks if serverAddress.includes(forRegistry), which incorrectly matches "private-registry.example.com" when requesting "registry.example.com". The matched credentials are then serialized into the X-Registry-Auth header and sent to the Docker daemon API for the wrong registry. Attack requires the victim to scan an image from a registry whose hostname is a substring of their private registry hostname; no special privileges or authentication are needed. The fix (available in v12.3.3 and PR #3964) replaces substring matching with normalizeRegistryHost and registriesMatch functions for strict hostname comparison. Affected versions: >=9.9.5 through 12.3.2.

Affected products

CycloneDX cdxgen >=9.9.5 through 12.3.2

Timeline

2026-05-08: disclosed
2026-05-08: patched: Fixed in version 12.3.3 (PR #3964)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.