CVE-2026-41888
published 2026-05-14CVE-2026-41888: Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2//manifests/ endpoint bypasses…
PriorityP337medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
EPSS
0.29%
21.6th percentile
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2//manifests/ endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| distribution | distribution | < 3.1.1 | 3.1.1 |
| github.com | distribution_distribution | 0 – 2.8.3 | — |
| github.com | distribution_distribution_v3 | >= 0 < 3.1.1 | 3.1.1 |
| openshift3 | ose-operator-lifecycle-manager | — | — |
| openshift4 | ose-operator-framework-tools-rhel9 | — | — |
| openshift4 | ose-operator-lifecycle-manager | — | — |
| openshift4 | ose-operator-lifecycle-manager-rhel9 | — | — |
| openshift4 | ose-operator-registry | — | — |
| redhat | redhat-operator-index | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion
vendor_redhat·2026-05-14·CVSS 6.3
CVE-2026-41888 [MEDIUM] CWE-15 github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion
github.com/distribution/distribution: Distribution: Security bypass allows unauthorized tag deletion
A flaw was found in Distribution, a software toolkit used for managing container content. This vulnerability allows a remote attacker to bypass security settings designed to prevent the deletion of container tags. By sending a specific request, an attacker can remove tags from repositories even when the system administrator has explicitly disabled this function. This unauthorized action could lead to the removal of critical container references, potentially causing disruption or denial of service.
Package: openshift3/ose-operator-lifecycle-manager (Red Hat OpenShift Container Platform 4) - Fix deferred
Package: openshift4/ose-operator-framework-tools-rhel9 (Red Hat OpenShift Container Pl
VulDB
Distribution up to 3.1.0 Configuration /v2/manifests/ authorization
vuldb·2026-05-14·CVSS 6.3
CVE-2026-41888 [MEDIUM] Distribution up to 3.1.0 Configuration /v2/manifests/ authorization
A vulnerability marked as critical has been reported in Distribution up to 3.1.0. The affected element is an unknown function of the file /v2/manifests/ of the component Configuration Handler. The manipulation leads to incorrect authorization.
This vulnerability is documented as CVE-2026-41888. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
Distribution's tag deletion bypasses `storage.delete.enabled` configuration
ghsa·2026-05-04
CVE-2026-41888 [MEDIUM] CWE-863 Distribution's tag deletion bypasses `storage.delete.enabled` configuration
Distribution's tag deletion bypasses `storage.delete.enabled` configuration
### Summary
Tag deletion via the `DELETE /v2//manifests/` endpoint bypasses the `storage.delete.enabled: false` configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion.
### Details
When `storage.delete.enabled` is configured to false, digest-based manifest deletion is correctly rejected by the guard in [registry/storage/linkedblobstore.go:212-215](https://github.com/distribution/distribution/blob/main/registry/storage/linkedblobstore.go#L213-L215).
However, tag deletion takes a separate code path that never checks this setting:
In [`registry/handlers/manifests.go:439-453`](https://github.com/distribution/distribution/blob/main/registry/ha
No detection rules found.
No public exploits indexed.
2026-05-14
Published