Read the docs
TI-2026-71920 Aliases CVE-2026-85747GHSA-685w-q87j-wqw3

Distribution client does not verify manifest content against digest

Priority MEDIUM 63CWE-354Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Distribution versions before 3.1.2 are affected, and github.com/docker/distribution through 2.8.3 is affected too. The client's manifest retrieval does not check the returned manifest content against the requested digest (CWE-354). A malicious or intercepted registry response can substitute attacker-chosen manifest content even when it claims the requested digest, and the bundled pull-through proxy can cache and re-serve that content.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix Partial distribution (distribution): 3.1.2github.com/distribution/distribution/v3 (Go): 3.1.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
distributiondistributionbefore 3.1.23.1.2Patch availableCNA
—github.com/docker/distribution (Go)up to 2.8.3—No fix listedGHSA-685w-q87j-wqw3
—github.com/distribution/distribution/v3 (Go)before 3.1.23.1.2Patch availableGHSA-685w-q87j-wqw3
  • distribution Vendordistribution Affected before 3.1.2 Fixed in 3.1.2 Patch available CNA
  • github.com/docker/distribution (Go) Vendor— Affected up to 2.8.3 Fixed in — No fix listed GHSA-685w-q87j-wqw3
  • github.com/distribution/distribution/v3 (Go) Vendor— Affected before 3.1.2 Fixed in 3.1.2 Patch available GHSA-685w-q87j-wqw3

Remediation

Distribution is fixed in version 3.1.2 (module github.com/distribution/distribution/v3). The sources list no fixed version for github.com/docker/distribution. Red Hat lists Red Hat OpenShift AI (RHOAI) as affected without a fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA distribution (distribution) Fixed in 3.1.2
  • Fix · GHSA-685w-q87j-wqw3 github.com/distribution/distribution/v3 (Go) Fixed in 3.1.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-85747
  2. 2026-10-14 Priority changed: MEDIUM → LOW
  3. 2026-10-16 Alias added: GHSA-685w-q87j-wqw3
  4. 2026-10-16 Fix available: Go/github.com/distribution/distribution/[email protected] · GHSA-685w-q87j-wqw3
  5. 2026-10-16 CVSS score added · GHSA-685w-q87j-wqw3
  6. 2026-10-16 Weakness changed · GHSA-685w-q87j-wqw3
  7. 2026-10-16 6 new references · GHSA-685w-q87j-wqw3
  8. 2026-10-18 CISA SSVC decision points changed
  9. 2026-10-18 Priority changed: LOW → MEDIUM
  10. 2026-11-06 Affected versions changed · Red Hat
  11. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

Other 5

  • TI-2026-27326 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation CVSS 3.1HIGH 7.5
  • TI-2026-25933 Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm CVSS 3.1HIGH 7.5
  • TI-2025-18656 Distribution's token authentication allows attacker to inject an untrusted signing key in a JWT CVSS 4.0MEDIUM 6.6
  • TI-2026-30291 Distribution: Tag deletion bypasses `storage.delete.enabled` configuration CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences