---
id: CVE-2026-61833
title: >-
  zot is a container image and artifact registry based on the Open Container
  Initiative Distribution Specification
summary: >-
  zot is a container image and artifact registry based on the Open Container
  Initiative Distribution Specification. Prior to 2.1.18, the bearer
  authentication handler in pkg/api/authn.go maps every HTTP method other than
  GET and HEAD to th…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-285
vendor: zot
product: zotregistry.dev/zot/v2
affected:
  - zotregistry.dev/zot/v2 < 2.1.18
patched:
  - zotregistry.dev/zot/v2 2.1.18
published: '2026-09-18'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T17:16:59.010'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61833'
references:
  - url: >-
      https://github.com/project-zot/zot/commit/7bb211bcd4352b90f3e99752607fbd1f050bf7ca
    label: security-advisories@github.com
  - url: 'https://github.com/project-zot/zot/pull/4161'
    label: security-advisories@github.com
  - url: 'https://github.com/project-zot/zot/releases/tag/v2.1.18'
    label: security-advisories@github.com
  - url: 'https://github.com/project-zot/zot/security/advisories/GHSA-qg67-7m6v-qg25'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-qg67-7m6v-qg25'
  - url: 'https://github.com/project-zot/zot'
tags:
  - nvd
  - ghsa
  - go
  - cve.org
  - osv
aliases:
  - GHSA-qg67-7m6v-qg25
ecosystem: go
ingestedAt: '2026-09-18T17:46:41.521Z'
epss: 0.00425
epssPercentile: 0.36305
---

## Overview

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-61833)

Affected packages:

- `zotregistry.dev/zot/v2 < 2.1.18`

Patched in:

- `zotregistry.dev/zot/v2 2.1.18`

Source: https://github.com/advisories/GHSA-qg67-7m6v-qg25