THREAT OPS › Threat News › [GHSA] GHSA-qg67-7m6v-qg25 (high) — zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
[GHSA] GHSA-qg67-7m6v-qg25 (high) — zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
GHSA-qg67-7m6v-qg25 Severity: high CVE: CVE-2026-61833
zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion
### Summary
A bearer token with only `pull` and `push` scopes can successfully delete manifests and blobs from a zot registry. The bearer authentication handler maps all non-GET/HEAD HTTP methods, including DELETE, to the `"push"` action, and the `DistSpecA
Indicators of compromise
- 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8asha256
- CVE-2026-61833cve
- https://distribution.github.io/distribution/spec/auth/scope/url
- http://127.0.0.1:5001/v2/poc-test/blobs/uploads/?digest=sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8aurl
- http://127.0.0.1:5001/v2/poc-test/manifests/v1.0url
Original source: https://github.com/advisories/GHSA-qg67-7m6v-qg25