zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.
Summary
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| project-zot | zot | before 2.1.18 | 2.1.18 | Patch available | CNA |
| — | zotregistry.dev/zot/v2 (Go) | before 2.1.18 | 2.1.18 | Patch available | GHSA-qg67-7m6v-qg25 |
- zot Vendorproject-zot Affected before 2.1.18 Fixed in 2.1.18 Patch available CNA
- zotregistry.dev/zot/v2 (Go) Vendor— Affected before 2.1.18 Fixed in 2.1.18 Patch available GHSA-qg67-7m6v-qg25
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zotregistry:zot:*:*:*:*:*:*:*:* | — | — | project-zot |
- cpe:2.3:a:zotregistry:zot:*:*:*:*:*:*:*:* Versions — — ·project-zot
Remediation
- Fix · CNA zot (project-zot) Fixed in 2.1.18
- Fix · GHSA-qg67-7m6v-qg25 zotregistry.dev/zot/v2 (Go) Fixed in 2.1.18 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61833
- 2026-10-03 Alias added: GHSA-qg67-7m6v-qg25
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
More project-zot vulnerabilities
- TI-2025-16993 IdP group membership revocation ignored in zot CVSS 3.1HIGH 7.3
- TI-2026-24356 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required) CVSS 3.1HIGH 7.7
- TI-2025-30700 zot logs secrets CVSS 4.0MEDIUM 5.5
- TI-2024-26792 Cache driver GetBlob() allows read access to any blob without access control check CVSS 3.1MEDIUM 4.3
Sources
- CVE-2026-61833 · CVE Program
- CVE-2026-61833 · NVD
- FIRST EPSS
- GHSA-qg67-7m6v-qg25 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences