VulnSocial

CVE-2026-61833Disclosure

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the fine-grained DistSpecAuthzHandler path in pkg/api/authz.go, while DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a bearer token limited to pull and push actions can therefore delete manifests and blobs within the token's repository scope, making images unavailable and allowing repository history to be altered despite the token lacking delete authorization. This issue is fixed in version 2.1.18.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-19: 1Technical Details · 2026-09-19: 109-19
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • NewNormal Security@NewScanTeam
    Disclosure

    NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 19 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🖥️ Container registry open to anonymous push, or running a build whose bearer-token check can be bypassed — every image, and a tag they can overwrite (zot CVE-2026-61833) 🖥️ Database console on the internet — a login in front of a database whose permission checks any account can walk around (ArcadeDB CVE-2026-93593, CVE-2026-93594, CVE-2026-93595, CVE-2026-93598) 🖥️ Self-hosted AI model server with no authentication — free inference on your GPUs, and one bad request stops the engine for everyone (as seen in vLLM CVE-2026-93592) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #ExposedInterface #CSO #REDTEAM

    Post summary

    The tweet discloses multiple CVEs with technical details, including vulnerability types and affected components, while promoting a self-hosted scanning tool. While specific technical details are provided, there is no mention of active exploitation, PoCs, or patches.

    0001066
    7 followersView on X

Explore more

Back to dashboard