Distribution CVE-2026-85747

Exploitation requires the attacker to control the manifest HTTP response for a digest-pinned request - achieved either by operating a malicious or compromised registry the victim pulls from, or by holding a man-in-the-middle position on the registry connection (e.g., TLS interception). The vulnerable path is registry/client manifests.Get() when the manifest is fetched by digest (byDigest, i.e., digestOrTag empty); the attacker forges the Docker-Content-Digest header to match the requested digest while serving different bytes. Impact is amplified when the bundled pull-through proxy (registry/proxy/proxymanifeststore.go) is deployed, since it caches and re-serves the substituted manifest to downstream clients. Affected: distribution prior to 3.1.2. Limiting factors: the attacker needs a privileged network position or a malicious registry (reflected as AC:H), there is no availability or confidentiality impact, and clients that fetch by tag rather than by digest are outside this specific verification path.

This is a genuine but conditional supply-chain integrity flaw rather than a drop-everything emergency. The CVSS 3.1 base score of 6.8 (vector AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) correctly captures the shape: network-reachable and unauthenticated, but with HIGH attack complexity because exploitation requires the attacker to control the manifest response - either by operating a malicious/compromised registry or by holding a man-in-the-middle position on the registry connection. There is no confidentiality or availability impact (C:N/A:N); the entire harm is integrity (I:H), and the scope change (S:C) reflects that the bundled pull-through proxy can cache and re-serve the substituted manifest to other downstream clients. On exploitation signals: no EPSS score was provided in the input, the CVE is NOT in CISA KEV, and no public exploit code was referenced, so exploitation status is 'no public exploit identified at time of analysis.' The real-world significance is that digest pinning is a security control users explicitly rely on for content-addressed integrity, and this bug silently voids that guarantee (CWE-354) - but the AC:H prerequisite (privileged network position or malicious registry) and absence of any exploitation evidence place this below internet-facing RCE-class issues in priority. Note one inconsistency to verify: the input tag 'Information Disclosure' conflicts with the CVSS (C:N, I:H) and CWE-354, which describe an integrity/tampering issue, not disclosure.

A victim client (or a pull-through proxy built on distribution < 3.1.2) requests a manifest pinned by digest, expecting content-addressed integrity. An attacker operating a malicious registry or sitting in a man-in-the-middle position returns an attacker-chosen manifest while forging the Docker-Content-Digest header to claim the requested digest; because manifests.Get() never hashes the body against the pinned digest, the forged content is accepted. No public exploit code was identified, but the flaw is trivially demonstrable given control of the response, and the bundled proxy will then cache and re-serve the poisoned manifest to other clients.