The docker_pull module in BBOT 2.0.0 uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validating its authenticity. This allows an attacker in a man-in-the-middle position to modify the header and redirect authentication requests to an arbitrary endpoint. Such redirection could lead to leakage of authentication tokens. The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and has a CVSS 3.1 base score of 3.1, indicating low severity. There is no vendor advisory or patch available at this time.

An attacker capable of intercepting and modifying network traffic between BBOT and a Docker registry could exploit this vulnerability to redirect authentication requests to a malicious server. This may result in the exposure of authentication tokens. However, the impact is limited by the requirement of man-in-the-middle positioning and the low CVSS score reflects limited confidentiality impact and no integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider mitigating man-in-the-middle risks by using secure network channels (e.g., TLS with certificate validation) and monitoring for suspicious network activity related to Docker registry authentication.