Cloudanix VulnDB

CVE-2026-33540

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Apr 6, 2026

CISA due date

—

The record

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.

Affected packages

Ecosystem Package Introduced Fixed
Chainguard envoy-gateway-egctl 0 1.7.1-r3
Chainguard envoy-gateway-fips-egctl 0 1.7.1-r3
Chainguard gitness 0 3.3.0-r12
Chainguard kots 0 1.130.0-r3
Chainguard zot 0 2.1.15-r8
Wolfi envoy-gateway-egctl 0 1.7.1-r3
Wolfi gitness 0 3.3.0-r12
Wolfi kots 0 1.130.0-r3
Wolfi zot 0 2.1.15-r8
openSUSE:Tumbleweed distribution 0 3.1.0-1.1

Related vulnerabilities