{"id":"CVE-2026-12566","details":"The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position between bbot and a Docker registry could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.","aliases":["GHSA-3mp7-vp6j-2mxx","PYSEC-2026-2391"],"modified":"2026-07-15T07:32:16.799140Z","published":"2026-06-17T23:17:03.100Z","references":[{"type":"FIX","url":"https://github.com/blacklanternsecurity/bbot/commit/c2f4bc0f4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/blacklanternsecurity/bbot","events":[{"introduced":"0"},{"fixed":"c2f4bc0f4"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-12566.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"}]}