AIKIDO-2026-10299

TL;DR

Affected versions of this package are vulnerable to improper enforcement of administrative controls in the Docker v2 authentication endpoint. When a Docker registry client is administratively disabled, the endpoint continues to issue authentication tokens for that client. This allows previously valid credentials to still obtain tokens despite the client being marked as disabled, potentially allowing unintended access to container registry resources.