CVE-2026-61833: zot registry bearer authentication delete authorization bypass

CVE-2026-61833 · Severity: high · CVSS 8.1 · Published 2026-09-18

zot is a container image registry that uses bearer tokens to authenticate and authorize API requests. A flaw in its authentication handler allows any client with a push-only token to delete container images and blobs, even though the token was explicitly issued without delete permissions. In CI/CD environments, this could allow a compromised build system to destroy production container images and disrupt service availability.

Technologies: zotregistry.dev/zot (Go). Vendors: Go.

Quick answers

Is CVE-2026-61833 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61833 being exploited in the wild.
How severe is CVE-2026-61833?
High severity, with a CVSS score of 8.1, published 18 September 2026.
Which products and versions are affected?
zotregistry.dev/zot (Go) SEMVER:introduced=0; zotregistry.dev/zot/v2 (Go) < 2.1.18, SEMVER:introduced=0,fixed=2.1.18; Zot through 2.1.15.
Is there a fix for CVE-2026-61833?
Yes. zotregistry.dev/zot/v2 (Go): upgrade to 2.1.18 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61833 attacked?
It is attacked over the network.
Am I affected by CVE-2026-61833?
Check whether you run zotregistry.dev/zot (Go), zotregistry.dev/zot/v2 (Go) or Zot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • zotregistry.dev/zot/v2 (Go): upgrade to 2.1.18 or later
    go get zotregistry.dev/zot/v2@v2.1.18

Technical details

The vulnerability stems from two interacting flaws in the bearer authentication and authorization middleware. First, the authentication handler incorrectly maps all non-GET/HEAD HTTP methods (including DELETE) to the "push" action, collapsing DELETE, PUT, PATCH, and POST into a single scope. Second, when a request is authenticated via bearer token, the DistSpecAuthzHandler middleware that performs fine-grained action inference is bypassed entirely, and neither DeleteManifest nor DeleteBlob handlers perform independent authorization checks. This violates the Docker Distribution Token Authentication Specification, which defines "delete" as a distinct action separate from "push". An attacker holding a push-only bearer token can exploit this to delete arbitrary manifests and blobs within the token's repository scope by sending DELETE requests that are incorrectly mapped to the push action and bypass authorization checks. A fix is available that distinguishes DELETE in the action mapping and ensures bearer-authenticated requests receive proper authorization checks.

Affected products

  • zot zot through 2.1.15

Identifiers

  • CVE-2026-61833
  • GHSA-qg67-7m6v-qg25
  • GO-2026-6527

Timeline

  • 2026-09-18: disclosed: GHSA-qg67-7m6v-qg25 published
  • 2025-01-01: other: Reported CVE-2026-61833 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.