CVE-2026-33540
Fixed in a distro release EPSS <1%CVSS 7.5
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.
Products: distribution
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/distribution/distribution | no fix |
| Go | github.com/distribution/distribution/v3 | 3.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argocd-image-updater | 1.3.0-r0 |
| Chainguard | argocd-image-updater-fips | 1.3.0-r0 |
| Chainguard | envoy-gateway-egctl | 1.7.1-r3 |
| Chainguard | envoy-gateway-fips-egctl | 1.7.1-r3 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r0 |
| Chainguard | gitlab-rails-ce-18.2 | no fix |
| Chainguard | gitlab-rails-ce-18.3 | no fix |
| Chainguard | gitlab-rails-ce-18.4 | no fix |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.10 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.6-r0 |
| Chainguard | gitlab-rails-ce-fips-18.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.3 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.4 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | no fix |
| Chainguard | gitlab-rails-ce-fips-19.0 | no fix |
| Chainguard | gitness | 3.3.0-r12 |
| Chainguard | harbor-2.12 | no fix |
| Chainguard | harbor-2.12-exporter | no fix |
| Chainguard | harbor-2.12-jobservice | no fix |
| Chainguard | harbor-2.12-registryctl | no fix |
| Chainguard | harbor-2.13 | no fix |
| Chainguard | harbor-2.13-exporter | no fix |
| Chainguard | harbor-2.13-jobservice | no fix |
| Chainguard | harbor-2.13-registryctl | no fix |
| Chainguard | harbor-2.14 | no fix |
| Chainguard | harbor-2.14-exporter | no fix |
| Chainguard | harbor-2.14-jobservice | no fix |
| Chainguard | harbor-2.14-registryctl | no fix |
| Chainguard | harbor-2.15 | no fix |
| Chainguard | harbor-2.15-exporter | no fix |
| Chainguard | harbor-2.15-jobservice | no fix |
| Chainguard | harbor-2.15-registryctl | no fix |
| Chainguard | harbor-fips-2.12 | no fix |
| Chainguard | harbor-fips-2.12-exporter | no fix |
| Chainguard | harbor-fips-2.12-jobservice | no fix |
| Chainguard | harbor-fips-2.12-registryctl | no fix |
| Chainguard | harbor-fips-2.13 | no fix |
| Chainguard | harbor-fips-2.13-exporter | no fix |
| Chainguard | harbor-fips-2.13-jobservice | no fix |
| Chainguard | harbor-fips-2.13-registryctl | no fix |
| Chainguard | harbor-fips-2.14 | no fix |
| Chainguard | harbor-fips-2.14-exporter | no fix |
| Chainguard | harbor-fips-2.14-jobservice | no fix |
| Chainguard | harbor-fips-2.14-registryctl | no fix |
| Chainguard | harbor-fips-2.15 | no fix |
| Chainguard | harbor-fips-2.15-exporter | no fix |
| Chainguard | harbor-fips-2.15-jobservice | no fix |
| Chainguard | harbor-fips-2.15-registryctl | no fix |
| Chainguard | kots | 1.130.0-r3 |
| Chainguard | portieris | 0.13.38-r0 |
| Chainguard | portieris-fips | 0.13.38-r0 |
| Chainguard | zot | 2.1.15-r8 |
| Debian 12 | docker-registry | no fix |
| Debian 13 | docker-registry | no fix |
| Debian 14 | docker-registry | 2.8.3+ds1-3 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise Module for Containers 15 SP7 | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | distribution | 3.1.1-150400.9.41.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | distribution | 3.1.1-150400.9.41.1 |
| Ubuntu 20.04 LTS | docker-registry | no fix |
| Ubuntu 24.04 LTS | docker-registry | no fix |
| Ubuntu 25.10 | docker-registry | no fix |
| Ubuntu 26.10 | docker-registry | no fix |
| Ubuntu Pro 16.04 LTS | docker-registry | no fix |
| Ubuntu Pro 18.04 LTS | docker-registry | no fix |
| Ubuntu Pro 22.04 LTS | docker-registry | no fix |
| Ubuntu Pro 26.04 LTS | docker-registry | no fix |
| Wolfi | argocd-image-updater | 1.3.0-r0 |
| Wolfi | envoy-gateway-egctl | 1.7.1-r3 |
| Wolfi | gitness | 3.3.0-r12 |
| Wolfi | harbor-2.14 | no fix |
| Wolfi | harbor-2.14-exporter | no fix |
| Wolfi | harbor-2.14-jobservice | no fix |
| Wolfi | harbor-2.14-registryctl | no fix |
| Wolfi | kots | 1.130.0-r3 |
| Wolfi | portieris | 0.13.38-r0 |
| Wolfi | zot | 2.1.15-r8 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | distribution | 3.1.0-1.1 |