CVE-2026-61833High· 8.1▾ MidnightPoC availablezot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to th…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Exploit / PoC code exists
Last analysed / modified upstream
0.4% → 0.8%
zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
zotregistry.dev/zot/v2 < 2.1.18Patched in:
zotregistry.dev/zot/v2 2.1.18Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-71426High· 7.1Contrast is a confidential-computing runtime for Kubernetes
CVE-2025-10278Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2025-10275Medium· 6.3YunaiV yudao-cloud transfer improper authorization
CVE-2025-10276Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2026-114249High· 7.3dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization
CVE-2026-114245High· 7.3dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization