CVE-2026-35172 Details
Description
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.
A vulnerability exists in the Distribution toolkit, specifically in versions through 3.0.x and 2.8.x when the Redis blob descriptor cache and deletion are both enabled. This issue allows for an authorization bypass at the repository level, where deleted blob links can be restored and accessed again, violating confidentiality expectations. The problem arises because the deletion process clears the shared digest descriptor but fails to remove the associated repository-scoped membership in Redis. As a result, a later request from a peer repository can repopulate the shared descriptor, making the deleted blob accessible once more.
Users are advised to update to Distribution version 3.1.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:23234 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:25045 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:26529 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:26543 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:28893 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:37387 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-35172 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2455571 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35172.json | redhat-SADP | |
| https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
| CWE-524 | Use of Cache Containing Sensitive Information | redhat-SADP |
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| distribution distribution | < 3.1.0 |
CPE
Remediation
| |
Change History
14 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | redhat-SADP |
| Sep 4, 2026 | CVE Modified | [email protected] |
| Aug 17, 2026 | CVE Modified | redhat-SADP |
| Aug 11, 2026 | CVE Modified | redhat-SADP |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 10, 2026 | CVE Modified | redhat-SADP |
| Jul 2, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |