Skip to content
OpenAdvisories

Package · Go

zotregistry.dev/zot/v2

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-61833

    zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

    zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELE…

    project-zot zot zotregistry.dev/zot zotregistry.dev/zot/v2 Go
  • High 7.7
    CVE-2026-31801

    zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

    zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by defau…

    project-zot zot zotregistry.dev/zot zotregistry.dev/zot/v2 Go