Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M
CVE-2026-31801zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)
High 7.7
In plain English
A high-severity incorrect authorization in zot from project-zot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | zotregistry.dev/zot | no fix listed | GHSA-85jx-fm8m-x8c6 |
| Go | zotregistry.dev/zot | no fix listed | GO-2026-4668 |
| Go | zotregistry.dev/zot/v2 | 2.1.15 | GHSA-85jx-fm8m-x8c6 |
| Go | zotregistry.dev/zot/v2 | 2.1.15 | GO-2026-4668 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| project-zot | zot | >= 1.3.0, < v2.1.15 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
References
- https://github.com/project-zot/zot/security/advisories/GHSA-85jx-fm8m-x8c6 x_refsource_CONFIRM