« Volver al listado

CVE-2026-31801

Estado: AnalizadaAlta (7.7)—

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N, PR:L y acceso a servicio remoto (registry) → T1210. Usuario con permisos limitados evita verificación de autorización para sobrescribir manifiestos, ganando acceso indebido (T1078) y manipulando datos de imagen (T1565.002).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

Zotregistry — ZOT

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-31801",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-31801",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-11T15:37:29.566804Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "project-zot",
          "product": "zot",
          "versions": [
            {
              "status": "affected",
              "version": ">= 1.3.0, < v2.1.15"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-10T21:16:49.850",
  "references": [
    {
      "url": "https://github.com/project-zot/zot/security/advisories/GHSA-85jx-fm8m-x8c6",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != \"latest\". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15."
    },
    {
      "lang": "es",
      "value": "zot es un registro de imágenes/artefactos de contenedores basado en la Especificación de Distribución de Open Container Initiative. Desde la versión 1.3.0 hasta la 2.1.14, el middleware de autorización dist-spec de zot infiere la acción requerida para PUT /v2/{name}/manifests/{reference} como 'crear' por defecto, y solo cambia a 'actualizar' cuando la etiqueta ya existe y reference != 'latest'. Como resultado, cuando 'latest' ya existe, un usuario al que se le permite crear (pero no se le permite actualizar) aún puede pasar la verificación de autorización para un intento de sobrescritura de 'latest'. Esta vulnerabilidad se corrige en la versión 2.1.15."
    }
  ],
  "lastModified": "2026-06-17T10:34:29.377",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zotregistry:zot:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "221F7F0D-2FD7-45AB-9A1A-5F1AFA35153F",
              "versionEndExcluding": "2.1.15",
              "versionStartIncluding": "1.3.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}