CVE-2024-35192

CVE-2024-35192 is a medium-severity vulnerability in Trivy, a security scanner, affecting versions prior to 0.51.2. A malicious actor could exploit this by tricking Trivy into scanning container images from a crafted registry, leading to the leakage of credentials for legitimate registries like AWS ECR, Google Cloud Registry, or Azure Container Registry. The attack requires user interaction and high attack complexity, but successful exploitation could result in unauthorized push/pull operations on affected registries. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.