7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31801

CVE-2026-31801: zot create-only policy allows overwrite attempts of existing latest tag (update permission not required)

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0 to 2.1.14, zot’s dist-spec authorization middleware infers the required action for PUT /v2/{name}/manifests/{reference} as create by default, and only switches to update when the tag already exists and reference != "latest". As a result, when latest already exists, a user who is allowed to create (but not allowed to update) can still pass the authorization check for an overwrite attempt of latest. This vulnerability is fixed in 2.1.15.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31801

CVE-2026-31801:

7.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
zotregistry.dev/zot/v2	go	< 2.1.15	2.1.15
zotregistry.dev/zot	go	>= 1.3.0-20210831063041-c8779d9e87d9, <= 1.4.4-20251014054906-73eef25681af

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is located in the DistSpecAuthzHandler function in pkg/api/authz.go. This function is a middleware that checks user permissions before allowing an image manifest push. The logic to distinguish between creating a new tag (create permission) and overwriting an existing tag (update permission) was flawed. Specifically, the condition if err == nil && slices.Contains(tags, reference) && reference != "latest" would only trigger an update permission check if the tag being pushed was not latest. This created a loophole where a user with only create permissions could overwrite the latest tag, as the action was not correctly identified as an update. The fixing commit ace12e2a12d0e104f6fb0aecf162b29e8c67b8a9 removes the && reference != "latest" part of the condition, ensuring that any attempt to overwrite an existing tag, including latest, correctly requires update permission. The analysis of the patch directly points to DistSpecAuthzHandler as the single vulnerable function.

Vulnerable functions

DistSpecAuthzHandler

pkg/api/authz.go

The `DistSpecAuthzHandler` function incorrectly handled authorization for updating image tags. It was designed to require 'update' permission when a tag already exists. However, it contained a specific exception for the 'latest' tag, which meant that overwriting the 'latest' tag was always treated as a 'create' action, thus not requiring 'update' permission. This allowed a user with only 'create' permission to overwrite the 'latest' tag.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.