CVE-2026-61833: falha de alta gravidade em project-zot zot
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.8%
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
project-zot · zotCVEs relacionadas — project-zot zot
No mesmo produto, das mais perigosas para as menos.
CVE-2025-23208HIGHIdP group membership revocation ignored in zotEPSS 0.4%CVE-2024-39897MEDIUMCache driver GetBlob() allows read access to any blob without access control checkEPSS 0.3%CVE-2026-31801HIGHzot create-only policy allows overwrite attempts of existing latest tag (update permission not required)EPSS 0.2%CVE-2025-48374MEDIUMzot logs secretsEPSS 0.2%