CVE-2026-33540: Distribution Auth Bypass Vulnerability

CVE-2026-33540 Overview

Distribution is a toolkit to pack, ship, store, and deliver container content. A Server-Side Request Forgery (SSRF) vulnerability exists in the pull-through cache mode of Distribution prior to version 3.1.0. The vulnerability allows an attacker to redirect credential authentication requests to an attacker-controlled endpoint by exploiting improper validation of the realm URL in WWW-Authenticate bearer challenges.

Critical Impact

Attackers with control of an upstream registry or man-in-the-middle position can steal authentication credentials configured for upstream registries by redirecting basic auth requests to attacker-controlled servers.

Affected Products

• Distribution (Go module) versions prior to 3.1.0
• Container registries running Distribution in pull-through cache mode
• Environments with configured upstream registry credentials

Discovery Timeline

• 2026-04-06 - CVE-2026-33540 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-33540

Vulnerability Analysis

This vulnerability (CWE-918: Server-Side Request Forgery) occurs in Distribution's pull-through cache functionality. When operating in pull-through cache mode, Distribution acts as a caching proxy for upstream container registries. To authenticate with upstream registries, Distribution parses WWW-Authenticate challenges to discover token authentication endpoints.

The core issue is that Distribution does not validate whether the realm URL specified in a bearer authentication challenge actually belongs to the configured upstream registry host. This allows an attacker who controls the upstream registry response, or who has a man-in-the-middle position, to specify an arbitrary realm URL.

When Distribution processes a malicious bearer challenge containing an attacker-controlled realm URL, it will send the configured upstream credentials via basic authentication to that attacker-controlled endpoint. This results in credential theft, potentially compromising access to the legitimate upstream registry.

Root Cause

The root cause is insufficient validation of the token authentication realm URL extracted from WWW-Authenticate bearer challenges. Distribution trusts the realm URL provided in the challenge response without verifying that it corresponds to the legitimate upstream registry domain. This violates the security principle of validating all external input before use, especially when that input influences where sensitive credentials are transmitted.

Attack Vector

The attack can be executed through two primary vectors:

1. Malicious Upstream Registry: An attacker who can convince an administrator to configure a malicious upstream registry URL can directly control the authentication challenge response.

2. Man-in-the-Middle Attack: An attacker positioned between Distribution and a legitimate upstream registry can intercept the initial authentication challenge and modify the realm URL to point to an attacker-controlled server.

In both scenarios, the authentication flow proceeds as follows: Distribution sends a request to the upstream registry, receives a 401 response with a WWW-Authenticate header containing a bearer challenge with a malicious realm URL, and then sends the configured credentials to that malicious realm endpoint.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it particularly dangerous in environments where Distribution is exposed to untrusted networks or upstream registries.

Detection Methods for CVE-2026-33540

Indicators of Compromise

• Unexpected outbound connections from Distribution servers to unfamiliar IP addresses or domains during registry authentication
• Authentication requests to realm URLs that don't match configured upstream registry hostnames
• Unusual 401 responses from upstream registries with modified WWW-Authenticate headers
• Network traffic patterns showing credential submission to non-registry endpoints

Detection Strategies

• Monitor network traffic from Distribution instances for authentication requests to unexpected destinations
• Implement egress filtering and alerting for Distribution servers to detect connections to unauthorized endpoints
• Review Distribution logs for authentication failures or unexpected realm URL resolutions
• Deploy network intrusion detection rules to identify WWW-Authenticate headers with suspicious realm URLs

Monitoring Recommendations

• Enable detailed logging in Distribution to capture authentication flow details including realm URLs
• Set up alerts for authentication requests to IP addresses or domains not in an approved allowlist
• Monitor for certificate errors or TLS warnings that may indicate MITM attempts
• Implement baseline monitoring of typical upstream registry communication patterns to detect anomalies

How to Mitigate CVE-2026-33540

Immediate Actions Required

• Upgrade Distribution to version 3.1.0 or later immediately
• Audit current upstream registry configurations for potentially malicious entries
• Review network logs for any signs of credential exfiltration prior to patching
• Rotate any credentials configured for upstream registry authentication as a precaution
• Implement network segmentation to limit Distribution's outbound connectivity to known registry endpoints

Patch Information

The vulnerability is fixed in Distribution version 3.1.0. The patch adds validation to ensure that realm URLs in bearer authentication challenges match the expected upstream registry host before transmitting credentials. Organizations should upgrade to version 3.1.0 or later to remediate this vulnerability. For detailed information about the fix, see the GitHub Security Advisory.

Workarounds

• Implement network-level controls to restrict Distribution's outbound connectivity to only approved upstream registry domains and authentication endpoints
• Use a forward proxy with strict allowlisting between Distribution and upstream registries to prevent connections to unauthorized endpoints
• Deploy Distribution in environments with robust network monitoring to detect anomalous authentication traffic
• Consider temporarily disabling pull-through cache mode if immediate patching is not possible and the risk is deemed unacceptable
• Implement TLS certificate pinning or validation at the network layer to mitigate MITM attack scenarios

Network-level mitigation can be implemented using firewall rules or proxy configurations that restrict outbound traffic from Distribution instances to only the expected upstream registry hosts and their legitimate authentication endpoints.