CVE-2026-41888

In pull-through cache mode, Distribution (prior to 3.1.0) discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host, allowing an attacker-controlled upstream (or an attacker in a MitM position) to cause Distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. The vulnerability is fixed in 3.1.0.

In the Distribution library (registry/client) prior to 3.1.2, the Get() method reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest. This allows a malicious or intercepted registry response to substitute attacker-chosen manifest content even when the Docker-Content-Digest header claims the requested value. The bundled pull-through proxy can additionally cache and re-serve the substituted manifest. The issue is fixed in version 3.1.2.

In Distribution (a container packaging and distribution toolkit) prior to version 3.1.0, when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled, deleting a blob from repo a does not fully clear the Redis cache entries. After a later read from repo b, the deleted blob becomes readable again in repo a.