CVE-2026-33540 Details
Description
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mode, distribution discovers token auth endpoints by parsing WWW-Authenticate challenges returned by the configured upstream registry. The realm URL from a bearer challenge is used without validating that it matches the upstream registry host. As a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled realm URL. This vulnerability is fixed in 3.1.0.
A vulnerability exists in the Distribution toolkit, specifically in versions prior to 3.1.0, within the pull-through cache mode. The issue arises because Distribution improperly validates the realm URL from bearer challenges received from the upstream registry, allowing an attacker-controlled upstream or a man-in-the-middle to intercept and redirect upstream authentication credentials via basic auth to a malicious realm URL. This flaw leads to unauthorized disclosure of sensitive authentication information, particularly concerning the upstream credentials used in the pull-through cache.
Users are advised to update to Distribution version 3.1.0 or later, and to ensure that the token realm destination is validated against the intended trust boundary before associating or sending authentication credentials. A conservative approach would be to only accept a realm whose host matches the configured upstream host.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/distribution/distribution/security/advisories/GHSA-3p65-76g6-3w7r | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/distribution/distribution/security/advisories/GHSA-3p65-76g6-3w7r | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| distribution project distribution | < 3.1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |