This CVE exposes a trust-model failure in regclient: the client followed redirects to foreign blob URLs and transmitted registry credentials to whatever host the registry named. The vulnerability is not a code defect in the traditional sense — it's a failure to define the trust boundary between a registry and the external services it may reference.
The OCI distribution-spec explicitly permits foreign blobs — artifacts hosted outside the registry — and allows registries to redirect clients to external URLs. The spec provides no guidance on whether clients should treat those redirect destinations as trusted. Regclient implemented redirect following as a convenience feature, inheriting the pattern from HTTP client libraries that treat 3xx responses as mechanical routing rather than trust decisions. When a registry redirected regclient to a foreign blob URL, the client sent its Authorization header along with the request — effectively handing credentials to an arbitrary external host.
Version 0.11.5 suppresses credentials for foreign blob redirects. Verify that your deployed version is 0.11.5 or later. However, assess whether other redirect-following paths in your client remain unaffected. Same-origin redirects — where a malicious registry redirects within its own domain to a path that logs the Authorization header — are not addressed by the patch. A compromised registry does not need to redirect externally; it can redirect to an internal endpoint that captures credentials.
The blast radius of OCI credential exfiltration is significant: these credentials authenticate to an entire namespace, not a single artifact. One leaked credential grants pull access to every repository in that registry's domain. In federated deployments — common in environments that proxy external sources — a compromised upstream registry exposes all downstream consumers.
Treat redirects as security-relevant operations. Verify that any client handling OCI artifacts scopes credentials to the registry's origin and rejects credential transmission to redirect destinations, whether foreign or same-origin. Given the spec's narrow fix, expect this vulnerability class to recur in other OCI clients until the distribution-spec provides normative guidance on credential handling for foreign blobs.