CVE-2026-61833

Overview

An authorization bypass vulnerability exists in the bearer authentication handler of zot container registry prior to version 2.1.18. Non-GET and non-HEAD HTTP methods incorrectly map to push actions, allowing tokens with limited permissions to perform unauthorized image and blob deletions. This breaks access control boundaries and risks unexpected data loss or repository tampering.

Description

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.

Impact

The vulnerability primarily impacts the integrity and availability of container images stored within the registry. Attackers possessing restricted tokens lacking explicit delete authorization can delete manifests and blobs within their repository scope. This leads to service disruption, broken image deployments, and altered repository history. Confidentiality remains unaffected as unauthorized read access is not the core issue here.

Remediation

Upgrade the zot container registry to version 2.1.18 or later where the bearer authentication handler correctly validates delete permissions. Audit existing bearer tokens and role-based access control assignments to ensure least-privilege principles are maintained. Monitor registry access logs for anomalous DELETE requests originating from restricted accounts.

Risk context

Rated as high severity with a CVSS v3 score of 8.1, this flaw exposes critical artifact registries to unauthorized modifications. Organizations utilizing zot for internal or public container distribution should prioritize patching to prevent integrity violations.

Affected products

• zot container registry < 2.1.18