zotregistry.dev vulnerabilities

Products

• zotregistry.dev/zot 5

Latest zotregistry.dev CVEs

Newest publication first

1. CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

   Published 2026-09-18

   High·CVSS 8.1 EPSS 0.81%

   zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not c...

2. CVE-2026-31801 zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

   Published 2026-03-10

   High·CVSS 7.7 EPSS 0.24%

   zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches...

3. CVE-2025-48374 zot logs secrets

   Published 2025-05-22

   Medium·CVSS 5.5 EPSS 0.18%

   zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into t...

4. CVE-2025-23208 IdP group membership revocation ignored in zot

   Published 2025-01-17

   Medium·CVSS 5.3 EPSS 0.42%

   zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, t...

5. CVE-2024-39897 Cache driver GetBlob() allows read access to any blob without access control check

   Published 2024-07-09

   Medium·CVSS 4.3 EPSS 0.30%

   zot is an OCI image registry. Prior to 2.1.0, the cache driver GetBlob() allows read access to any blob without access control check. If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.