Log in Start free

Vulnerability · Published Sep 18, 2026 · Assigned by GitHub_M

CVE-2026-61833zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

High 8.1

In plain English

A high-severity security flaw in zot from project-zot. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.8%top 42.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gozotregistry.dev/zotno fix listedGO-2026-6527
Gozotregistry.dev/zot/v22.1.18GHSA-qg67-7m6v-qg25
Gozotregistry.dev/zot/v22.1.18GO-2026-6527

Affected products (as reported)

VendorProductVersions
project-zot zot < 2.1.18

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References