https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T11:42:59.480781+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-31801 fkie_cve-2026-31801 2026-10-01T11:42:59.775057+00:00

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.

 https://vulnerability.circl.lu/vuln/ghsa-85jx-fm8m-x8c6 GHSA-85jx-fm8m-x8c6 — zot’s create-only policy allows overwrite attempts of existing latest tag (update permission not required) 2026-10-01T11:42:59.775170+00:00

Affected: Go: zotregistry.dev/zot/v2, Go: zotregistry.dev/zot

zot’s dist-spec authorization middleware infers the required action for `PUT /v2/{name}/manifests/{reference}` as `create` by default, and only switches to `update` when the tag already exists and `reference != "latest"`.

as a result, when `latest` already exists, a user who is allowed to `create` (but not allowed to `update`) can still pass the authorization check for an overwrite attempt of `latest`.

## affected component

- file: `pkg/api/authz.go` (`DistSpecAuthzHandler`) - condition: `slices.Contains(tags, reference) && reference != "latest"` (line 352 at the pinned commit)

## severity

HIGH category: CWE-863 (incorrect authorization)

note: impact depends on how a deployment uses `latest` (for example, if `latest` is treated as a protected or “push-once” tag), and on how access control is provisioned (users with `create` but without `update`). the attached poc demonstrates a real overwrite of `latest` (tag digest changes) under a create-only policy.

## steps to reproduce

1. configure access control so user `attacker` has `create` but not `update` on a repository. 2. ensure the repository has an existing tag named `latest`. 3. attempt to push a new manifest to `/v2/acme/app/manifests/latest` (example repository name). 4. observe that the authorization check is evaluated as `create` (not `update`) for `latest`, so the request passes authorization even though the tag already exists.

the attached poc demonstrates this deterministically with `canonical.log` and `contr…