CVE-2026-61833: zot Registry Authorization Bypass Vulnerability

CVE-2026-61833 Overview

CVE-2026-61833 is an authorization bypass vulnerability [CWE-285] in zot, an Open Container Initiative (OCI) container image and artifact registry. Versions prior to 2.1.18 contain a flaw in the bearer authentication handler in pkg/api/authn.go. The handler maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are never checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go. A remote attacker holding a bearer token limited to pull and push scopes can delete manifests and blobs within the token's repository scope.

Critical Impact
Attackers with pull/push-only bearer tokens can delete container manifests and blobs, making images unavailable and enabling tampering with repository history.

Affected Products

zot container image and artifact registry versions prior to 2.1.18
Deployments using bearer token authentication
OCI Distribution Specification-compliant registries running affected zot builds

Discovery Timeline

2026-09-18 - CVE-2026-61833 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61833

Vulnerability Analysis

The vulnerability resides in zot's bearer authentication middleware. The handler classifies incoming HTTP requests into scope actions before validating the bearer token's authorized scopes. Only GET and HEAD are mapped to the pull action; every other method, including DELETE, is coerced into the push action. This coarse mapping means the token authorization check for a DELETE request only verifies the caller can push, not that the caller can delete.

Compounding the issue, bearer-authenticated requests skip the DistSpecAuthzHandler path in pkg/api/authz.go that would otherwise enforce fine-grained permissions. The DeleteManifest and DeleteBlob handlers perform no independent delete-permission check of their own. The result is a broken access control chain where the intended distinction between push and delete scopes is not enforced for bearer-authenticated callers.

Root Cause

The root cause is improper authorization [CWE-285] driven by an incomplete HTTP-method-to-action mapping. The authentication middleware collapses the OCI Distribution scope model into a two-action decision, dropping the delete action entirely. No downstream handler compensates for this, leaving delete operations gated only by push authorization.

Attack Vector

An attacker who obtains a bearer token scoped for pull and push on a repository can issue DELETE requests against manifests and blobs in that repository. The registry accepts the requests, removes the referenced artifacts, and alters the repository history. No local access, user interaction, or elevated privileges beyond a valid pull/push token are required.

// Patch excerpt from pkg/api/authn.go
				vars := mux.Vars(request)
				name := vars["name"]

-				action := "pull"
-				if m := request.Method; m != http.MethodGet && m != http.MethodHead {
+				var action string
+				switch m := request.Method; m {
+				case http.MethodHead, http.MethodGet:
+					action = "pull"
+				case http.MethodPost, http.MethodPatch, http.MethodPut:
					action = "push"
+				case http.MethodDelete:
+					action = "delete"
+				default:
+					action = "pull" // default to pull for other methods, e.g., OPTIONS
				}

				requestedAccess = &ResourceAction{
// Source: https://github.com/project-zot/zot/commit/7bb211bcd4352b90f3e99752607fbd1f050bf7ca

The patch introduces an explicit switch statement that maps DELETE to the delete action, restoring the intended scope distinction.

Detection Methods for CVE-2026-61833

Indicators of Compromise

Unexpected HTTP DELETE requests against /v2/<name>/manifests/<reference> or /v2/<name>/blobs/<digest> endpoints in zot access logs
Successful 2xx responses to delete operations from clients whose bearer tokens should only permit pull or push
Missing manifests or blobs in repositories that were not modified by trusted CI/CD pipelines
Repository tag history changes that do not correlate with authorized publisher activity

Detection Strategies

Parse zot server logs to correlate DELETE method requests with the scopes present in the presenting bearer token
Alert on any DELETE handled successfully when the token's granted actions do not include delete
Baseline normal delete volume per repository and flag statistically significant spikes

Monitoring Recommendations

Forward zot audit and access logs to a centralized SIEM for retention and correlation
Monitor registry storage backends for unexpected object deletions from container repositories
Track bearer token issuance from the authorization server and correlate token identifiers with delete actions

How to Mitigate CVE-2026-61833

Immediate Actions Required

Upgrade zot to version 2.1.18 or later on all registry instances
Rotate bearer tokens issued by the authorization server to invalidate any tokens that may have been abused
Audit repository contents for missing manifests or blobs and restore from backup or CI republish where necessary
Review authorization server policies to ensure delete scope is granted only to trusted principals

Patch Information

The fix is available in zot v2.1.18. The change is implemented in pull request #4161 and commit 7bb211b. Full details are in the GitHub Security Advisory GHSA-qg67-7m6v-qg25.

Workarounds

Disable bearer authentication and switch to htpasswd or mTLS-based authentication until the upgrade is applied
Place zot behind a reverse proxy that blocks DELETE requests from untrusted clients or unscoped tokens
Restrict bearer token issuance to trusted CI/CD service accounts and shorten token lifetimes

bash

# Example reverse proxy rule (nginx) to block DELETE on registry endpoints
location ~ ^/v2/.+/(manifests|blobs)/ {
    limit_except GET HEAD POST PUT PATCH {
        deny all;
    }
    proxy_pass http://zot_upstream;
}