Most recent entries from all

bdu:2026-07972

BIT-distribution-2026-41888 — Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Affected: Bitnami: distribution

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

EUVD-2026-318611

fkie_cve-2026-41888

GHSA-6pjf-3r9x-m592 — Distribution's tag deletion bypasses `storage.delete.enabled` configuration

Affected: Go: github.com/distribution/distribution/v3, Go: github.com/distribution/distribution

### Summary

Tag deletion via the `DELETE /v2/<name>/manifests/<tag>` endpoint bypasses the `storage.delete.enabled: false` configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion.

### Details

When `storage.delete.enabled` is configured to false, digest-based manifest deletion is correctly rejected by the guard in [registry/storage/linkedblobstore.go:212-215](https://github.com/distribution/distribution/blob/main/registry/storage/linkedblobstore.go#L213-L215).

However, tag deletion takes a separate code path that never checks this setting:

In [`registry/handlers/manifests.go:439-453`](https://github.com/distribution/distribution/blob/main/registry/handlers/manifests.go#L439-L453), `DeleteManifest` detects a tag reference, calls `tagService.Untag()`, returns, never consulting `registry.deleteEnabled`.

In turn, [`tagStore.Untag()`](https://github.com/distribution/distribution/blob/main/registry/storage/tagstore.go#L111-L121) calls the storage driver directly to delete the tag path without checking whether deletes are enabled.

### PoC

Using a paired down Distribution configuration that explicitly disables deletes, such as this one, stored as `config.yaml`:

```yaml version: 0.1 storage: delete: enabled: false filesystem: rootdirectory: /var/lib/registry http: addr: :5000 ```

Start a local Distribution, mounting in the above configuration from the current directory:

```shell docker…

openSUSE-SU-2026:10812-1 — distribution-registry-3.1.1-1.1 on GA media

distribution-registry-3.1.1-1.1 on GA media

SUSE-SU-2026:21881-1 — Security update for helm

Security update for helm

UBUNTU-CVE-2026-41888

Affected: Ubuntu:Pro:16.04:LTS: docker-registry, Ubuntu:Pro:18.04:LTS: docker-registry, Ubuntu:20.04:LTS: docker-registry, Ubuntu:Pro:22.04:LTS: docker-registry, Ubuntu:24.04:LTS: docker-registry, Ubuntu:25.10: docker-registry, Ubuntu:Pro:26.04:LTS: docker-registry