Read the docs
TI-2026-27326 Aliases CVE-2026-35172GHSA-f2g3-hh2r-cwgc

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation

Priority HIGH 72CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00473 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial distribution (distribution): 3.1.0github.com/distribution/distribution/v3 (Go): 3.1.0Red Hat: 6 advisoriesRed Hat: 6 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
distributiondistributionbefore 3.1.03.1.0Patch availableCNA
—github.com/distribution/distribution/v3 (Go)before 3.1.03.1.0Patch availableGHSA-f2g3-hh2r-cwgc
—github.com/distribution/distribution (Go)up to 2.8.3—No fix listedGHSA-f2g3-hh2r-cwgc
  • distribution Vendordistribution Affected before 3.1.0 Fixed in 3.1.0 Patch available CNA
  • github.com/distribution/distribution/v3 (Go) Vendor— Affected before 3.1.0 Fixed in 3.1.0 Patch available GHSA-f2g3-hh2r-cwgc
  • github.com/distribution/distribution (Go) Vendor— Affected up to 2.8.3 Fixed in — No fix listed GHSA-f2g3-hh2r-cwgc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:distribution:distribution:*:*:*:*:*:*:*:*before 3.1.0Vulnerabledistribution
  • cpe:2.3:a:distribution:distribution:*:*:*:*:*:*:*:* Versions before 3.1.0 Vulnerable ·distribution

Remediation

  • Fix · CNA distribution (distribution) Fixed in 3.1.0
  • Fix · GHSA-f2g3-hh2r-cwgc github.com/distribution/distribution/v3 (Go) Fixed in 3.1.0 Advisory →

Red Hat 6 advisories

  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2026:28893 Released 2026-07-01 · Red Hat rating Important
    OpenShift Container Platform 4.14.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
  • RHSA-2026:26529 Released 2026-06-25 · Red Hat rating Important
    OpenShift Container Platform 4.12.92 bug fix and security update
    • Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/ose-operator-lifecycle-manager
Show 3 more Red Hat advisories
  • RHSA-2026:26543 Released 2026-06-25 · Red Hat rating Important
    OpenShift Container Platform 4.13.68 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-cluster-ingress-operator, registry.redhat.io/openshift4/ose-operator-lifecycle-manager
  • RHSA-2026:25045 Released 2026-06-17 · Red Hat rating Important
    OpenShift Container Platform 4.16.64 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/kube-metrics-server-rhel9, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9, registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator +5
  • RHSA-2026:23234 Released 2026-06-11 · Red Hat rating Important
    OpenShift Container Platform 4.15.65 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/ose-cluster-olm-operator-rhel8, registry.redhat.io/openshift4/ose-csi-driver-nfs-rhel9, registry.redhat.io/openshift4/ose-ibm-vpc-block-csi-driver-rhel9 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2026:26529
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2026:26543
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2026:28893
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2026:23234
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:25045
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
Not affected: 9 products
  • Multicluster Engine for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat Openshift Data Foundation 4.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35172
  2. 2026-10-03 Alias added: GHSA-f2g3-hh2r-cwgc
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-30291 Distribution: Tag deletion bypasses `storage.delete.enabled` configuration CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences