EUVD-2026-83187
GHSA-qg67-7m6v-qg25
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network-reachable API with a valid pull/push bearer token (PR:L, AC:L, UI:N); deletion alters history (I:H) and removes images (A:H); no data disclosure (C:N); single-component scope.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.
AnalysisAI
zot container registry versions prior to 2.1.18 mis-map the HTTP DELETE method to the "push" scope action in its bearer authentication handler, so an authenticated client holding a token scoped only to pull and push can delete manifests and blobs inside that token's repository scope. Because bearer-authenticated requests also skip the fine-grained DistSpecAuthzHandler and the DeleteManifest/DeleteBlob handlers perform no independent permission check, no delete authorization is ever required; the attacker can make images unavailable and alter repository history (CWE-285, CVSS 8.1). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the zot registry (< 2.1.18) to be configured for bearer/JWT token authentication (HTTP.Auth.Bearer with a realm/service), and the attacker must already hold a valid, unexpired bearer token whose scope covers the target repository with at least pull or push actions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, well-substantiated broken-access-control flaw (CWE-285), not a high-CVSS-but-low-real-risk paper cut. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to zot 2.1.18 or later, which is the vendor-released fix (Vendor-released patch: 2.1.18); the change is carried in PR https://github.com/project-zot/zot/pull/4161 and commit https://github.com/project-zot/zot/commit/7bb211bcd4352b90f3e99752607fbd1f050bf7ca, and the advisory is at https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every zot deployment and confirm which instances are configured for bearer/JWT authentication, since only those are exposed, and treat all repository-scoped tokens as potentially capable of deletion; rotate or narrow tokens for any registry that cannot be upgraded immediately and audit registry access logs for unexpected DELETE calls against manifests and blobs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Path traversal in the uniget CLI (Go module gitlab.com/uniget-org/cli) before version 0.27.6 lets a local user read and
Cross-scope secret disclosure in Perses (versions 0.43.0 through 0.54.0-rc.0) allows an authenticated user holding only
Same weakness CWE-285 – Improper Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today