Red Hat CVE-2026-33540

Upgrade distribution to version 3.1.0 or later, which implements proper validation of bearer challenge realm URLs to ensure they match the configured upstream registry domain before transmitting credentials. Organizations unable to immediately upgrade should disable pull-through cache functionality or remove upstream authentication credentials from distribution configuration, instead using unauthenticated public registries or implementing network-layer controls to prevent distribution from reaching attacker-controlled destinations. Deploy egress filtering to restrict distribution servers to communicate only with known-legitimate registry domains. Review authentication logs for the period prior to patching to identify potential unauthorized realm URL requests that may indicate exploitation attempts or successful credential theft. Rotate any upstream registry credentials that were configured in vulnerable distribution deployments. Consult the GitHub Security Advisory at https://github.com/distribution/distribution/security/advisories/GHSA-3p65-76g6-3w7r for additional vendor guidance and validation procedures.