Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
CVE-2026-41888 is a vulnerability in Distribution container toolkit versions prior to 3.1.1 that allows unauthorized tag deletion despite disabled deletion policies. The flaw bypasses the storage.delete.enabled configuration, enabling API clients to remove repository tags without proper authorization.
ثغرة في Distribution تسمح بحذف علامات الحاويات عند نقطة نهاية DELETE /v2/<name>/manifests/<tag> حتى عندما يكون الحذف معطلاً. تؤثر الثغرة على الإصدارات السابقة للإصدار 3.1.1 وتم إصلاحها في هذا الإصدار.
This vulnerability affects Distribution container toolkit versions before 3.1.1, allowing unauthorized deletion of container image tags even when deletion is explicitly disabled. The flaw bypasses security configurations that prevent tag removal from repositories.
Upgrade Distribution toolkit to version 3.1.1 or later immediately. Verify storage.delete.enabled configuration is properly enforced. Implement network-level access controls to restrict DELETE requests to the /v2/<name>/manifests/<tag> endpoint. Audit container registries for unauthorized tag deletions and review access logs for suspicious API activity.
قم بترقية أداة Distribution إلى الإصدار 3.1.1 أو أحدث فوراً. تحقق من أن إعدادات storage.delete.enabled مطبقة بشكل صحيح. طبق عناصر تحكم في الوصول على مستوى الشبكة لتقييد طلبات DELETE. قم بتدقيق السجلات للتحقق من حذف العلامات غير المصرح به.