CVE-2026-41888mediumCWE-863

CVE-2026-41888: falha de média gravidade em distribution

Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Publicada em

Seguir esta CVE+ Monitorar distribution+ Monitorar docker-registry

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.3%
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
distribution · distribution
CVEs relacionadas — distribution

No mesmo produto, das mais perigosas para as menos.

CVE-2026-35172HIGHDistribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidationEPSS 0.5%CVE-2025-24976MEDIUMDistribution's token authentication allows attacker to inject an untrusted signing key in a JWTEPSS 0.4%CVE-2026-33540HIGHDistribution affected by pull-through cache credential exfiltration via www-authenticate bearer realmEPSS 0.3%CVE-2026-85747MEDIUMDistribution: Client `manifests.Get()` does not verify returned content against requested digestEPSS 0.2%