CVE-2026-31801
Description
zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.
How to fix
- zotregistry zot2.1.15 or later
- zotregistry.dev/zot/v22.1.15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zotregistry zot | 1.3.0 ≤ v < 2.1.15 | 2.1.15 |
| zotregistry.dev/zot/v2Go | v < 2.1.15 | 2.1.15 |
| zotregistry.dev/zotGo | 1.3.0-20210831063041-c8779d9e87d9 ≤ v ≤ 1.4.4-20251014054906-73eef25681af, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.