CVE-2026-85747
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
In the Distribution library (registry/client) prior to 3.1.2, the Get() method reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest. This allows a malicious or intercepted registry response to substitute attacker-chosen manifest content even when the Docker-Content-Digest header claims the requested value. The bundled pull-through proxy can additionally cache and re-serve the substituted manifest. The issue is fixed in version 3.1.2.
Risk Assessment
An attacker can deliver a substituted container image, leading to execution of unauthorized code in production environments. This poses a software supply chain integrity risk.
Recommendation
Upgrade the Distribution library to version 3.1.2 or later. Verify whether the bundled pull-through proxy is in use and validate the integrity of pulled images.
Other vulnerabilities in Distribution
See all- CVE-2026-41888Medium
In Distribution (a toolkit to pack, ship, store, and deliver container content) prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
- CVE-2026-33540High
In pull-through cache mode, Distribution (prior to 3.1.0) discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host, allowing an attacker-controlled upstream (or an attacker in a MitM position) to cause Distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. The vulnerability is fixed in 3.1.0.
- CVE-2026-35172High
In Distribution (a container packaging and distribution toolkit) prior to version 3.1.0, when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled, deleting a blob from repo a does not fully clear the Redis cache entries. After a later read from repo b, the deleted blob becomes readable again in repo a.
Original NVD description (English source)
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS