CVE-2026-31801
Received Received - Intake
Authorization Bypass in zot dist-spec Middleware Allows Overwrite

Publication date: 2026-03-10

Last updated on: 2026-03-18

Assigner: GitHub, Inc.

Description
zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-10
Last Modified
2026-03-18
Generated
2026-06-16
AI Q&A
2026-03-10
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31801
EUVD
EUVD-2026-10890
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
zotregistry zot From 1.3.0 (inc) to 2.1.15 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, upgrade zot to version 2.1.15 or later, where the issue has been fixed.

Executive Summary

This vulnerability exists in zot, a container image/artifact registry, specifically in its dist-spec authorization middleware versions from 1.3.0 to 2.1.14. The middleware incorrectly infers the required action for the PUT request to update manifests. It defaults to 'create' unless the tag already exists and the reference is not 'latest'. Because of this, if the 'latest' tag already exists, a user who has permission to create but not update can still overwrite the 'latest' tag, bypassing the intended authorization checks.

This issue was fixed in version 2.1.15 of zot.

Impact Analysis

This vulnerability allows a user with create permissions, but without update permissions, to overwrite the 'latest' tag in the container registry. This can lead to unauthorized modification of container images or artifacts, potentially introducing malicious or unintended content into the registry.

Such unauthorized overwrites can compromise the integrity of container images used in deployments, leading to security risks such as running compromised containers or disrupting application behavior.

Compliance Impact

I don't know

Detection Guidance

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31801. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart