Skip to content
OpenAdvisories

Package · Go

zotregistry.dev/zot

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-61833

    zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

    zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELE…

    project-zot zot zotregistry.dev/zot zotregistry.dev/zot/v2 Go
  • High 7.7
    CVE-2026-31801

    zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

    zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by defau…

    project-zot zot zotregistry.dev/zot zotregistry.dev/zot/v2 Go
  • High 7.3
    CVE-2025-23208

    IdP group membership revocation ignored in zot

    zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the…

    project-zot zot zot zotregistry.dev/zot Wolfi Go