Container Registry cache write exploited (CVE-2026-66384) [PoC]

Actively exploited in the wild - CVE-2026-66384 is a medium severity path traversal flaw in Container Registry 2.x that lets an authenticated user write data outside the intended Docker cache path when pulling images from specific remote repositories. Patched in version 2.11.3; update immediately.

Overview

CVE-2026-66384 affects the Container Registry service, a core component responsible for storing and distributing Docker container images. Under specific conditions where the registry is configured with a remote repository as a caching proxy, an authenticated user can craft image pull requests that escape the designated cache directory and write arbitrary data to other locations on the host file system.

The vulnerability has a CVSS score of 5.3 (MEDIUM), reflecting the consensus that exploitation requires valid credentials and a non-default configuration. However, the attack vector is network-based and requires no user interaction, meaning the barrier to exploitation is the authentication requirement alone.

Impact

An attacker with valid registry credentials can write files to paths outside the cache directory on the host operating system. Depending on the registry’s deployment and file system permissions, this could allow:

• Overwriting configuration files or application binaries
• Creating malicious files that are later executed by other services
• Filling disk partitions to cause denial of service
• Potentially chaining with other vulnerabilities to achieve code execution

The CISA Known Exploited Vulnerabilities (KEV) catalog confirms active exploitation in the wild, despite the relatively low EPSS probability score of 0.3% over the next 30 days. The low EPSS suggests the exploitation may be targeted rather than opportunistic, making it especially important for organizations operating exposed registry instances to act promptly.

Remediation and Mitigation

Upgrade immediately to Container Registry 2.11.3 or later, which contains the official fix for this path traversal issue.

For organizations unable to patch immediately:

1. Restrict registry access to trusted users and networks only
2. Audit authentication logs for unusual pull patterns from remote repositories
3. Monitor file system activity for writes outside the expected cache directories
4. If remote-repository proxying is not required, disable this feature until the patch is applied

Organizations should also review their exposure to the CISA KEV catalog and prioritize patching known-exploited vulnerabilities across all internet-facing services. Related data breach reports are available at breach reports, and ongoing coverage of this and similar supply-chain threats can be found at security news.

Security Insight

This vulnerability highlights a recurring challenge in container infrastructure: caching and proxying features expand the attack surface in ways that are not always obvious to operators. The fact that this is already in the CISA KEV catalog despite the medium severity rating and low EPSS suggests that threat actors are actively scanning for registry instances with this misconfiguration. The registry’s role as a trusted component in the software supply chain means that even a file-write primitive deserves attention equivalent to higher-severity issues.

Further Reading

• All Medium Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs