Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-41888

Fixed in a distro release EPSS <1%CVSS 6.3

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Published 2026-05-14 · CVE record · OSV

Products: distribution

Fixed upstream

EcosystemPackageFixed in
Gogithub.com/distribution/distributionno fix
Gogithub.com/distribution/distribution/v33.1.1

Distro releases

ReleasePackageFixed in
Chainguardargocd-image-updater1.3.0-r0
Chainguardargocd-image-updater-fips1.3.0-r0
Chainguardenvoy-gateway-egctl1.7.2-r5
Chainguardenvoy-gateway-fips-egctl1.7.2-r2
Chainguardenvoy-gateway-fips-egctl1.7.2-r3
Chainguardgitlab-rails-ce-18.118.1.6-r10
Chainguardgitlab-rails-ce-18.1018.10.5-r1
Chainguardgitlab-rails-ce-18.1118.11.6-r0
Chainguardgitlab-rails-ce-18.3no fix
Chainguardgitlab-rails-ce-18.4no fix
Chainguardgitlab-rails-ce-18.5no fix
Chainguardgitlab-rails-ce-18.618.6.6-r4
Chainguardgitlab-rails-ce-18.718.7.6-r3
Chainguardgitlab-rails-ce-18.818.8.9-r1
Chainguardgitlab-rails-ce-18.9no fix
Chainguardgitlab-rails-ce-19.0no fix
Chainguardgitlab-rails-ce-fips-18.1no fix
Chainguardgitlab-rails-ce-fips-18.1018.10.4-r1
Chainguardgitlab-rails-ce-fips-18.1118.11.6-r0
Chainguardgitlab-rails-ce-fips-18.318.3.6-r7
Chainguardgitlab-rails-ce-fips-18.4no fix
Chainguardgitlab-rails-ce-fips-18.5no fix
Chainguardgitlab-rails-ce-fips-18.618.6.6-r4
Chainguardgitlab-rails-ce-fips-18.7no fix
Chainguardgitlab-rails-ce-fips-18.8no fix
Chainguardgitlab-rails-ce-fips-18.918.9.6-r1
Chainguardgitlab-rails-ce-fips-19.0no fix
Chainguardgitness3.3.0-r16
Chainguardharbor-2.12no fix
Chainguardharbor-2.12-exporterno fix
Chainguardharbor-2.12-jobserviceno fix
Chainguardharbor-2.12-registryctlno fix
Chainguardharbor-2.13no fix
Chainguardharbor-2.13-exporterno fix
Chainguardharbor-2.13-jobserviceno fix
Chainguardharbor-2.13-registryctlno fix
Chainguardharbor-2.14no fix
Chainguardharbor-2.14-exporterno fix
Chainguardharbor-2.14-jobserviceno fix
Chainguardharbor-2.14-registryctlno fix
Chainguardharbor-2.15no fix
Chainguardharbor-2.15-exporterno fix
Chainguardharbor-2.15-jobserviceno fix
Chainguardharbor-2.15-registryctlno fix
Chainguardharbor-fips-2.12no fix
Chainguardharbor-fips-2.12-exporterno fix
Chainguardharbor-fips-2.12-jobserviceno fix
Chainguardharbor-fips-2.12-registryctlno fix
Chainguardharbor-fips-2.13no fix
Chainguardharbor-fips-2.13-exporterno fix
Chainguardharbor-fips-2.13-jobserviceno fix
Chainguardharbor-fips-2.13-registryctlno fix
Chainguardharbor-fips-2.14no fix
Chainguardharbor-fips-2.14-exporterno fix
Chainguardharbor-fips-2.14-jobserviceno fix
Chainguardharbor-fips-2.14-registryctlno fix
Chainguardharbor-fips-2.15no fix
Chainguardharbor-fips-2.15-exporterno fix
Chainguardharbor-fips-2.15-jobserviceno fix
Chainguardharbor-fips-2.15-registryctlno fix
Chainguardkots1.130.2-r1
Chainguardportieris0.13.37-r1
Chainguardportieris0.13.38-r0
Chainguardportieris-fips0.13.38-r0
Chainguardzot2.1.16-r2
Debian 12docker-registryno fix
Debian 13docker-registryno fix
Debian 14docker-registryno fix
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSdistribution3.1.1-150400.9.41.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSdistribution3.1.1-150400.9.41.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSdistribution3.1.1-150400.9.41.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSdistribution3.1.1-150400.9.41.1
SUSE Linux Enterprise Module for Containers 15 SP7distribution3.1.1-150400.9.41.1
SUSE Linux Enterprise Server 15 SP4-LTSSdistribution3.1.1-150400.9.41.1
SUSE Linux Enterprise Server 15 SP5-LTSSdistribution3.1.1-150400.9.41.1
SUSE Linux Enterprise Server 15 SP6-LTSSdistribution3.1.1-150400.9.41.1
SUSE Linux Enterprise Server 16.0distribution3.1.1-160000.1.1
SUSE Linux Enterprise Server 16.0helm3.21.0-160000.1.1
SUSE Linux Enterprise Server 16.0helm4.3.0-160000.1.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4distribution3.1.1-150400.9.41.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5distribution3.1.1-150400.9.41.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6distribution3.1.1-150400.9.41.1
SUSE Linux Enterprise Server for SAP applications 16.0distribution3.1.1-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0helm4.3.0-160000.1.1
SUSE Linux Enterprise Server for SAP applications 16.0helm3.21.0-160000.1.1
SUSE Linux Micro 6.2helm4.3.0-160000.1.1
Ubuntu 20.04 LTSdocker-registryno fix
Ubuntu 24.04 LTSdocker-registryno fix
Ubuntu 25.10docker-registryno fix
Ubuntu 26.10docker-registryno fix
Ubuntu Pro 16.04 LTSdocker-registryno fix
Ubuntu Pro 18.04 LTSdocker-registryno fix
Ubuntu Pro 22.04 LTSdocker-registryno fix
Ubuntu Pro 26.04 LTSdocker-registryno fix
Wolfiargocd-image-updater1.3.0-r0
Wolfienvoy-gateway-egctl1.7.2-r5
Wolfigitness3.3.0-r16
Wolfiharbor-2.14no fix
Wolfiharbor-2.14-exporterno fix
Wolfiharbor-2.14-jobserviceno fix
Wolfiharbor-2.14-registryctlno fix
Wolfikots1.130.2-r1
Wolfiportieris0.13.37-r1
Wolfiportieris0.13.38-r0
Wolfizot2.1.16-r2
openSUSE Leap 16.0distribution3.1.1-160000.1.1
openSUSE Leap 16.0govulncheck-vulndb0.0.20260723T184607-160000.1.1
openSUSE Leap 16.0hauler2.1.0-bp160.3.1
openSUSE Leap 16.0hauler2.1.0-bp160.2.1
openSUSE Leap 16.0hauler2.1.0-bp160.1.1
openSUSE Leap 16.0helm4.3.0-160000.1.1
openSUSE Tumbleweeddistribution3.1.1-1.1
openSUSE Tumbleweedhauler2.0.3-1.1
openSUSE Tumbleweedhelm4.2.0-1.1
openSUSE Tumbleweedhelm33.21.0-1.1