BREW-cdxgen-GHSA-qhh4-458h-xwh2 — @cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

Affected: Homebrew: cdxgen

# Docker registry auth substring match forwards credentials to a different registry

## Repository

`cdxgen/cdxgen`

## Affected product/package

- Ecosystem: npm - Package: `@cyclonedx/cdxgen` - Reviewed tree version: `12.3.3` - Reviewed commit: `b1e179869fd7c6032c3d483c3f7bd4d7154ec22b` - Affected file: `lib/managers/docker.js` - Affected from: v9.9.5

The Single Executable Applications (SEA) binaries and container images are also affected.

## Weakness

CWE-522 / CWE-346.

## Summary

When cdxgen scans or pulls container images through the Docker daemon API, it builds an `X-Registry-Auth` header from Docker credentials in `DOCKER_CONFIG/config.json`. The credential selection logic matches configured registry keys with substring checks:

```js if (forRegistry && !serverAddress.includes(forRegistry)) { continue; } ```

This is not an origin-safe registry comparison. For example, credentials configured for `private-registry.example.com` are selected for a requested image under `registry.example.com`, because:

```js "private-registry.example.com".includes("registry.example.com") === true ```

The selected credentials are then serialized into `X-Registry-Auth` for the Docker API pull request targeting the requested registry.

## Reproduction

Use the attached/local proof:

```sh node submissions/github-gsa/cdxgen-docker-registry-auth-substring-forwarding/evidence/cdxgen_docker_registry_auth_substring_probe.mjs ```

The proof is fully local. It creates a temporary Docker con…

Most recent entries from all

BREW-cdxgen-GHSA-qhh4-458h-xwh2 — @cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry