TI-2025-30700 Aliases CVE-2025-48374 GHSA-c37v-3c8w-crq8

zot logs secrets

LOW 24CWE-532Published 2025-05-22 · Updated 2025-05-23

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00181 7th percentileScored 2026-11-07

Fix Fixed zot (project-zot): 1.4.4-0.20250522160828-8a99a3ed231fzotregistry.dev/zot (Go): 1.4.4-0.20250522160828-8a99a3ed231f

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
project-zot	zot	before 1.4.4-0.20250522160828-8a99a3ed231f	1.4.4-0.20250522160828-8a99a3ed231f	Patch available	CNA
—	zotregistry.dev/zot (Go)	before 1.4.4-0.20250522160828-8a99a3ed231f	1.4.4-0.20250522160828-8a99a3ed231f	Patch available	GHSA-c37v-3c8w-crq8

zot Vendorproject-zot Affected before 1.4.4-0.20250522160828-8a99a3ed231f Fixed in 1.4.4-0.20250522160828-8a99a3ed231f Patch available CNA
zotregistry.dev/zot (Go) Vendor— Affected before 1.4.4-0.20250522160828-8a99a3ed231f Fixed in 1.4.4-0.20250522160828-8a99a3ed231f Patch available GHSA-c37v-3c8w-crq8

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:zotregistry:zot::::::::	—	—	project-zot

cpe:2.3:a:zotregistry:zot:*:*:*:*:*:*:*:* Versions — — ·project-zot

Remediation

Fix · CNA zot (project-zot) Fixed in 1.4.4-0.20250522160828-8a99a3ed231f
Fix · GHSA-c37v-3c8w-crq8 zotregistry.dev/zot (Go) Fixed in 1.4.4-0.20250522160828-8a99a3ed231f Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-48374
2026-10-03 Alias added: GHSA-c37v-3c8w-crq8

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-48374

Other 4

TI-2025-16993 IdP group membership revocation ignored in zot CVSS 3.1HIGH 7.3
TI-2026-44252 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion CVSS 3.1HIGH 8.1
TI-2026-24356 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required) CVSS 3.1HIGH 7.7
TI-2024-26792 Cache driver GetBlob() allows read access to any blob without access control check CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences