CVE-2026-35172 distribution CVE debrief

Who should care

Defenders managing Distribution deployments, especially those using Redis for caching blob descriptors and enabling storage deletion, should assess their exposure and prioritize patching to prevent unauthorized read access to deleted blobs.

Why it matters

CVE-2026-35172 allows for the restoration of read access to deleted blobs in Distribution deployments with specific configurations. Defenders should verify and apply patches, review configurations, and monitor for unusual activity to prevent data exposure.

• Verification of patch application to prevent unauthorized read access
• Monitoring for unusual read access attempts on deleted blobs
• Review of storage configurations to ensure secure settings
• Potential data exposure through deleted but readable blobs

Technical summary

The Distribution toolkit, used for packing, shipping, storing, and delivering container content, has a vulnerability prior to version 3.1.0. When storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled, an explicit delete operation can leave behind stale repository-scoped membership information. This can cause a later Stat or Get operation from a different repository to repopulate the shared descriptor, making the deleted blob readable again from the original repository.

Defensive priority

Defenders should prioritize verifying and applying the patch to Distribution versions before 3.1.0, especially in environments where storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled.

Recommended defensive actions

• Verify Distribution version and apply patch if necessary
• Review configurations for storage.cache.blobdescriptor: redis and storage.delete.enabled: true
• Monitor for unusual read access attempts on deleted blobs
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability allows for the restoration of read access to deleted blobs in certain configurations. This issue is fixed in Distribution version 3.1.0. Defenders should verify patch application to prevent unauthorized read access, review configurations, and monitor for unusual activity to prevent data exposure. The evidence is limited, and defenders should exercise caution when verifying affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.