Insecure Hostname Validation Allows HTTP Downgrade Attack
Medium6.9CVE-2026-28909 · Published Apr 30, 2026
### Summary The `isInternalHost()` function in `RequestScheme.swift` uses insecure string prefix matching to determine whether a registry host should use HTTP or HTTPS. An attacker can craft hostnames (e.g., `localhost.evil.com`) that bypass this check, causing the client to send registry credentials over unencrypted HTTP connections. ### Impact Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This affects: - Registry login operations (username/password) - Image pull/push operations with authenticated registries - Any registry interaction using the default `--scheme auto` setting Bypass patterns include any hostname starting with: - `localhost` (e.g., `localhost.evil.com`) - `127.` (e.g., `127.evil.com`) - `192.168.` (e.g., `192.168.evil.com`) - `10.` (e.g., `10.evil.com`) - `172.16.` through `172.31.` (e.g., `172.16.evil.com`)
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| container Product | < 0.12.3 | 0.12.3 |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
- Severity from
- GitHub (reviewed advisory)
More Apple advisories
All Apple| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 21 | HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec | Low | 1.44.0 |
| May 21 | NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length | Medium | 1.34.1 |
| May 21 | NIOHTTP1 HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS | Medium | 2.100.0 |
| May 21 | Out-of-bounds write via ByteBuffer index and length UInt32 overflow | High | 2.100.0 |
| May 21 | CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator | Medium | 2.100.0 |
| Apr 30 | `container system dns create` unvalidated domain name allows pf rule injection | Low | 0.12.3 |