CVE-2026-41888CWE-863

Distribution: Tag deletion bypasses `storage.delete.enabled` configuration

Medium · published May 14, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00294 · 20.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-14T16:53Z
EPSS history
Timeline
  • 14 MAY 16:53Z
    Distribution: Tag deletion bypasses `storage.delete.enabled` configuration
    cvelistv5