Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-35172Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

High 7.5

In plain English

A high-severity improper access control in distribution from distribution. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 58.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12docker-registryno fix listedDEBIAN-CVE-2026-35172
Debian:13docker-registryno fix listedDEBIAN-CVE-2026-35172
Debian:14docker-registry2.8.3+ds1-3DEBIAN-CVE-2026-35172
Gogithub.com/distribution/distributionno fix listedGO-2026-4942
Gogithub.com/distribution/distributionno fix listedGHSA-f2g3-hh2r-cwgc
Gogithub.com/distribution/distribution/v33.1.0GHSA-f2g3-hh2r-cwgc
Gogithub.com/distribution/distribution/v33.1.0GO-2026-4942
Ubuntu:24.04:LTSdocker-registryno fix listedUBUNTU-CVE-2026-35172
Ubuntu:25.10docker-registryno fix listedUBUNTU-CVE-2026-35172
Ubuntu:26.10docker-registryno fix listedUBUNTU-CVE-2026-35172

Affected products (as reported)

VendorProductVersions
distribution distribution < 3.1.0

Weakness: CWE-284, CWE-524 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References