CVSS 3.1
7.7 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:NCVE-2026-31801
High (7.7) in zotregistry zot. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in zotregistry.dev/zot/v2 2.1.15.
zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zotregistry:zot
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-85jx-fm8m-x8c6 | Go | zotregistry.dev/zot/v2 | <2.1.15 | 2.1.15 |
| GHSA-85jx-fm8m-x8c6 | Go | zotregistry.dev/zot | >=1.3.0-20210831063041-c8779d9e87d9 <=1.4.4-20251014054906-73eef25681af | no fix published |
| GO-2026-4668 | Go | zotregistry.dev/zot | all versions | no fix published |
| GO-2026-4668 | Go | zotregistry.dev/zot/v2 | <2.1.15 | 2.1.15 |