PT-2026-37158 · Unknown+1 · Distribution+1

Joonas · CVE-2026-41888 · Published 2026-05-04 · Updated 2026-06-25

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Distribution versions prior to 3.1.1

Description An authorization bypass exists where tag deletion via the "/v2//manifests/" endpoint ignores the storage.delete.enabled: false configuration. This allows any API client to remove tags from repositories even when the operator has explicitly disabled deletion. The issue occurs because the DeleteManifest() function detects a tag reference and calls tagStore.Untag(), which interacts with the storage driver directly without verifying if deletes are enabled.

Recommendations Update to version 3.1.1.

Exploit

Fix

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2026-07972

CVE-2026-41888

GHSA-6PJF-3R9X-M592

GO-2026-5185

OPENSUSE-SU-2026:10812-1

OPENSUSE-SU-2026:10814-1

OPENSUSE-SU-2026:10824-1

OPENSUSE-SU-2026:20860-1

OPENSUSE-SU-2026:21084-1

SUSE-SU-2026:2049-1

SUSE-SU-2026:21881-1

SUSE-SU-2026:21915-1

SUSE-SU-2026:21952-1

SUSE-SU-2026:22001-1

SUSE-SU-2026:22159-1

Affected Products

Distribution

Red Os

References · 48

• 🔥 https://github.com/distribution/distribution/security/advisories/GHSA-6pjf-3r9x-m592 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41888.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41888 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6pjf-3r9x-m592 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:22001-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41888 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:22159-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10814-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5185 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21084-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41888 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10824-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41888 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41888 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10812-1 · Vendor Advisory