PT-2026-24461 · Zot · Zot

1Seal · Published 2026-03-10 · Updated 2026-03-25 · CVE-2026-31801

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions zot versions 1.3.0 through 2.1.14

Description zot is a container image/artifact registry based on the Open Container Initiative Distribution Specification. The dist-spec authorization middleware incorrectly infers the required action for PUT requests to the /v2/{name}/manifests/{reference} API endpoint as 'create' by default. It only switches to 'update' when the tag already exists and the reference is not 'latest'. This allows a user permitted to create, but not update, to overwrite the 'latest' tag when it already exists, bypassing authorization checks. The vulnerable parameter is reference.

Recommendations Update to version 2.1.15 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-31801

GHSA-85JX-FM8M-X8C6

GO-2026-4668

SUSE-SU-2026:1042-1

Affected Products

Zot

References · 135

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31801.json · Exploit
• https://github.com/project-zot/zot/security/advisories/GHSA-85jx-fm8m-x8c6 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-31801 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-85jx-fm8m-x8c6 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4668 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31801 · Security Note
• https://github.com/project-zot/zot/releases/tag/v2.1.15 · Note
• https://github.com/project-zot/zot · Note
• https://suse.com/security/cve/CVE-2026-30225 · Note
• https://suse.com/security/cve/CVE-2026-25921 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20261042-1 · Note
• https://suse.com/security/cve/CVE-2026-32136 · Note
• https://suse.com/security/cve/CVE-2026-27575 · Note
• https://suse.com/security/cve/CVE-2026-29188 · Note