chore(deps): update module github.com/regclient/regclient to v0.11.5 [security]

[agntcy-automation]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/regclient/regclient	v0.11.3 → v0.11.5

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

regclient may leak authentication credentials to external blob stores

CVE-2026-49349 / GHSA-qvqc-4c52-x6qp

More information

Details

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs.

Example attack

A malicious registry serves an OCI image manifest containing a layer descriptor with a urls field pointing to an attacker controlled host:

{
  "mediaType": "application/vnd.oci.image.layer.v1.tar+gzip",
  "digest": "sha256:...",
  "size": 1024,
  "urls": ["https://malicious.example.org/blobs/sha256/..."]
}

When regclient fetches the image and the primary blob request to the registry fails, it falls back to the URLs in the layer descriptor. If the external server requests authentication, regclient would send the credentials for the original registry server.

Timeline

• 2026-05-25: Advisory submitted
• 2026-05-26: Fix released

Credit

Theodoros Lampropoulos, Threat Detection Engineer, Odyssey Cyber Security

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

References

• https://github.com/regclient/regclient/security/advisories/GHSA-qvqc-4c52-x6qp
• https://github.com/regclient/regclient

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

regclient/regclient (github.com/regclient/regclient)

v0.11.5

Compare Source

Release v0.11.5

Security:

• Prevent https to non-https downgrades and localhost redirects. (PR 1093)
• Forbid sending auth on redirects. (PR 1095)

Features:

• Add regbot manifest.descriptor to the sandbox. (PR 1091)

Contributors:

• @​GimmyDatBeeR
• @​sudo-bmitch

v0.11.4

Compare Source

Release v0.11.4

Security:

• Validate server URL in token auth. (PR 1075)
• Upgrading Go fixes CVE-2026-33814 and CVE-2026-39836, other vulnerabilities fixed in 1.26.3 were not called by this project. (PR 1084)

Features:

• Support scanning OCI Layout for referrers. (PR 1074)
• Add created timestamp in OCI Layout entries. (PR 1081)
• tag.ls now accepts the same pagination parameters as repo.ls. (PR 1086)

Fixes:

• Push tags for minor and major releases on Docker Hub. (PR 1087)

Contributors:

• @​ffried
• @​sudo-bmitch

[agntcy-automation]

ℹ️ Artifact update notice

File name: samples/ard-over-ads/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
github.com/spiffe/go-spiffe/v2	v2.6.0 -> v2.8.1
golang.org/x/mod	v0.36.0 -> v0.37.0
k8s.io/apimachinery	v0.36.1 -> v0.36.2

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!