CVE-2026-31801: 
NixOS vulnerability analysis and mitigation

CVE-2026-31801 is an incorrect authorization vulnerability in zot, an OCI Distribution Specification-based container image/artifact registry. The flaw exists in zot's dist-spec authorization middleware, which incorrectly infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, only switching to update when the tag already exists and the reference is not "latest". This logic error allows a user with only create permissions to overwrite the existing latest tag without the required update permission. Affected versions span from 1.3.0 through 2.1.14; the vulnerability is fixed in version 2.1.15. It carries a CVSS v3.1 base score of 7.7 (High) (GitHub Advisory, zot Security Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization) and resides in pkg/api/authz.go within the DistSpecAuthzHandler function. The flawed condition slices.Contains(tags, reference) && reference != "latest" (line 352 at the pinned commit 3c7d5a5f1d40eb996ba1d56f28be57a3b77510af) means that when the reference is literally "latest", the middleware never upgrades the inferred action from create to update, even if the latest tag already exists in the registry. An attacker needs only low-level authenticated access (create permission on a repository) and a pre-existing latest tag to exploit this over the network with low complexity and no user interaction. A runnable proof-of-concept (poc.zip, RUNNABLE_POC.md) demonstrating deterministic tag digest replacement under a create-only policy is attached to the advisory (zot Security Advisory).

Successful exploitation allows an authenticated user with only create permissions to silently overwrite the latest manifest tag in a container image repository, replacing legitimate images with potentially malicious ones. This directly undermines least-privilege access control models and "push-once" immutability policies that deployments may rely upon. The most significant risk is supply-chain compromise: if latest is used as a high-trust tag in CI/CD pipelines, a create-only principal could inject a malicious container image that downstream systems would pull and execute, with no confidentiality or availability impact but a high integrity impact with changed scope (GitHub Advisory, zot Security Advisory).

A proof-of-concept exploit is publicly available as part of the GitHub Security Advisory (poc.zip, RUNNABLE_POC.md), with Feedly classifying exploit confidence as high based on concrete reproduction steps and runnable artifacts (zot Security Advisory). There is no current evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.044% (14th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report.

1. Reconnaissance: Identify a zot registry instance running versions 1.3.0 through 2.1.14. Confirm the target repository (e.g., acme/app) has an existing latest tag by querying GET /v2/acme/app/tags/list.
2. Obtain create-only credentials: Acquire or use existing credentials for an account that has create permission but explicitly lacks update permission on the target repository.
3. Prepare a malicious manifest: Craft or obtain a container image manifest (e.g., a modified OCI image manifest JSON) intended to replace the legitimate latest image.
4. Push the malicious manifest: Issue a PUT /v2/acme/app/manifests/latest HTTP request authenticated with the create-only credentials, supplying the malicious manifest body.
5. Authorization bypass occurs: The DistSpecAuthzHandler middleware evaluates the action as create (not update) because reference == "latest", allowing the request to pass the authorization check despite the tag already existing.
6. Verify overwrite: Confirm the tag digest has changed by querying GET /v2/acme/app/manifests/latest and comparing the digest to the original, as demonstrated by the canonical.log and control.log markers in the PoC (zot Security Advisory).

• Network: Unexpected PUT /v2/{name}/manifests/latest requests from accounts that should only have create (not update) permissions; repeated manifest push attempts to the latest tag from unusual source IPs or service accounts.
• Logs: Registry access logs showing successful PUT responses (201/202) to /v2/{name}/manifests/latest by users without documented update authorization; discrepancies between expected and actual manifest digests for the latest tag.
• File System / Registry State: Unexpected changes in the digest associated with the latest tag in the registry's storage backend; new or modified manifest blobs corresponding to unauthorized pushes.
• CI/CD Pipeline: Downstream systems pulling a latest image with an unexpected digest or content hash, potentially triggering build or deployment failures or unexpected behavior (zot Security Advisory).

The primary remediation is to upgrade zot to version 2.1.15 or later, which removes the special-case exemption for latest in the authorization middleware so that overwriting any existing tag — including latest — correctly requires update permission (GitHub Advisory, zot Security Advisory). As an interim workaround prior to patching, administrators should audit and tighten access control policies to ensure that any user who can push to a repository also has update permission explicitly granted (eliminating the create-without-update split for sensitive repositories). Additionally, monitor registry logs for unauthorized PUT requests to latest tags and consider implementing external tag immutability controls or admission webhooks in downstream CI/CD systems.

The vulnerability was reported by researcher 1seal and published by maintainer rchincha on March 9, 2026 via the GitHub Security Advisory program. A Bluesky post from the cyberhub.blog account noted the advisory shortly after publication. No major vendor statements, widespread media coverage, or significant community debate beyond the advisory itself have been identified.