CVE-2026-33540
HighCVSS 7.5Summary
In pull-through cache mode, Distribution (prior to 3.1.0) discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host, allowing an attacker-controlled upstream (or an attacker in a MitM position) to cause Distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. The vulnerability is fixed in 3.1.0.
Risk Assessment
An attacker can capture upstream registry credentials, enabling unauthorized access to private container images and further supply chain attacks. The risk is particularly relevant in environments with untrusted or compromised upstream registries.
Recommendation
Update Distribution to version 3.1.0 or later. Verify the trustworthiness of configured upstream registries and consider enforcing TLS connections with certificate validation.
Other vulnerabilities in Distribution
See all- CVE-2026-41888Medium
In Distribution (a toolkit to pack, ship, store, and deliver container content) prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
- CVE-2026-85747Medium
In the Distribution library (registry/client) prior to 3.1.2, the Get() method reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest. This allows a malicious or intercepted registry response to substitute attacker-chosen manifest content even when the Docker-Content-Digest header claims the requested value. The bundled pull-through proxy can additionally cache and re-serve the substituted manifest. The issue is fixed in version 3.1.2.
- CVE-2026-35172High
In Distribution (a container packaging and distribution toolkit) prior to version 3.1.0, when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled, deleting a blob from repo a does not fully clear the Redis cache entries. After a later read from repo b, the deleted blob becomes readable again in repo a.
Original NVD description (English source)
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS