Executive brief
zot is a container image registry that uses bearer tokens to authenticate and authorize API requests. A flaw in its authentication handler allows any client with a push-only token to delete container images and blobs, even though the token was explicitly issued without delete permissions. In CI/CD environments, this could allow a compromised build system to destroy production container images and disrupt service availability.
Technical details
The vulnerability stems from two interacting flaws in the bearer authentication and authorization middleware. First, the authentication handler incorrectly maps all non-GET/HEAD HTTP methods (including DELETE) to the "push" action, collapsing DELETE, PUT, PATCH, and POST into a single scope. Second, when a request is authenticated via bearer token, the DistSpecAuthzHandler middleware that performs fine-grained action inference is bypassed entirely, and neither DeleteManifest nor DeleteBlob handlers perform independent authorization checks. This violates the Docker Distribution Token Authentication Specification, which defines "delete" as a distinct action separate from "push". An attacker holding a push-only bearer token can exploit this to delete arbitrary manifests and blobs within the token's repository scope by sending DELETE requests that are incorrectly mapped to the push action and bypass authorization checks. A fix is available that distinguishes DELETE in the action mapping and ensures bearer-authenticated requests receive proper authorization checks.
Affected products
- zot zot through 2.1.15
Timeline
- 2026-09-18: disclosed: GHSA-qg67-7m6v-qg25 published
- 2025-01-01: other: Reported CVE-2026-61833 assigned