CVE-2026-41888
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
May 14, 2026
CISA due date
—
The record
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | distribution | 0 | 3.1.1-160000.1.1 |
| openSUSE:Tumbleweed | distribution | 0 | 3.1.1-1.1 |
| openSUSE:Tumbleweed | helm | 0 | 4.2.0-1.1 |
| openSUSE:Tumbleweed | helm3 | 0 | 3.21.0-1.1 |
Related vulnerabilities
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects distribution
- CVE-2026-46597 An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM… Also affects distribution
- CVE-2026-46598 For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire… Also affects distribution
- CVE-2026-42508 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for… Also affects distribution
- CVE-2026-46595 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server… Also affects distribution
- CVE-2026-39835 SSH servers which use CertChecker as a public key callback without setting… Also affects distribution
- CVE-2026-39834 When writing data larger than 4GB in a single Write call on an SSH channel, an integer… Also affects distribution
- CVE-2026-39829 The RSA and DSA public key parsers did not enforce size limits on key parameters. Also affects distribution