GHSA-6pjf-3r9x-m592 — Distribution's tag deletion bypasses `storage.delete.enabled` configuration

2026-09-30T15:24:10.513936+00:00

Affected: Go: github.com/distribution/distribution/v3, Go: github.com/distribution/distribution

### Summary

Tag deletion via the `DELETE /v2//manifests/` endpoint bypasses the `storage.delete.enabled: false` configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion.

### Details

When `storage.delete.enabled` is configured to false, digest-based manifest deletion is correctly rejected by the guard in [registry/storage/linkedblobstore.go:212-215](https://github.com/distribution/distribution/blob/main/registry/storage/linkedblobstore.go#L213-L215).

However, tag deletion takes a separate code path that never checks this setting:

In [`registry/handlers/manifests.go:439-453`](https://github.com/distribution/distribution/blob/main/registry/handlers/manifests.go#L439-L453), `DeleteManifest` detects a tag reference, calls `tagService.Untag()`, returns, never consulting `registry.deleteEnabled`.

In turn, [`tagStore.Untag()`](https://github.com/distribution/distribution/blob/main/registry/storage/tagstore.go#L111-L121) calls the storage driver directly to delete the tag path without checking whether deletes are enabled.

### PoC

Using a paired down Distribution configuration that explicitly disables deletes, such as this one, stored as `config.yaml`:

```yaml version: 0.1 storage: delete: enabled: false filesystem: rootdirectory: /var/lib/registry http: addr: :5000 ```

Start a local Distribution, mounting in the above configuration from the current directory:

```shell docker…

Most recent entries from all

GHSA-6pjf-3r9x-m592 — Distribution's tag deletion bypasses `storage.delete.enabled` configuration