Source: docker-registry Version: 2.8.3+ds1-2 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for docker-registry. CVE-2026-41888[0]: | Distribution is a toolkit to pack, ship, store, and deliver | container content. Prior to 3.1.1, tag deletion via the DELETE | /v2/<name>/manifests/<tag> endpoint bypasses the | storage.delete.enabled: false configuration, allowing any API client | to remove tags from repositories even when the operator has | explicitly disabled deletion. This vulnerability is fixed in 3.1.1. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-41888 https://www.cve.org/CVERecord?id=CVE-2026-41888 [1] https://github.com/distribution/distribution/security/advisories/GHSA-6pjf-3r9x-m592 [2] https://github.com/distribution/distribution/commit/8baf3e08266a19590cc5d4725f3976a9a876d4bf Please adjust the affected versions in the BTS as needed. Regards, Salvatore
