CVE-2026-35172 distribution CVE debrief

Who should care

Users of the Distribution toolkit, especially those using versions prior to 3.1.0, should be aware of this vulnerability. It is crucial for administrators and developers using this toolkit to ensure they are running the latest version to prevent potential unauthorized access to deleted container content.

Technical summary

The Distribution toolkit, used for packing, shipping, storing, and delivering container content, had a vulnerability that allowed for the restoration of read access to deleted blobs under certain conditions. When both storage.cache.blobdescriptor: redis and storage.delete.enabled: true were enabled, an explicit delete operation would clear the shared digest descriptor but leave behind stale repository-scoped membership information. This would allow a later Stat or Get operation from a different repository to repopulate the shared descriptor, making the deleted blob readable again from the original repository. The fix for this vulnerability is included in version 3.1.0 of the Distribution toolkit.

Defensive priority

High priority should be given to updating the Distribution toolkit to version 3.1.0 or later. Administrators should review their current configurations and ensure that the fixes are applied to prevent potential exploitation.

Recommended defensive actions

• Update the Distribution toolkit to version 3.1.0 or later.
• Review current configurations of storage.cache.blobdescriptor and storage.delete.enabled.
• Ensure that all instances of the Distribution toolkit are patched.
• Monitor for any suspicious access to deleted container content.
• Consider implementing additional security measures to protect sensitive data.

Evidence notes

The CVE-2026-35172 vulnerability was identified in the Distribution toolkit. The vulnerability allows for restored read access to deleted container content under specific configurations. The issue was publicly disclosed on April 6, 2026, and a fix was provided in version 3.1.0. The CVSS score for this vulnerability is 7.5, indicating a high severity level.

Official resources