Vulnerability GO-2026-5094
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
June 25, 2026 at 06:26 PM UTC
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution
v2.0.0-alpha.0+incompatible - v2.8.3+incompatible
v2.0.0-alpha.0+incompatible - v2.8.3+incompatible
Summary
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution
Details
Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm in github.com/distribution/distribution
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
6 hours ago
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
v3.0.0-alpha.1 - v3.1.1 GHSA-685w-q87j-wqw3
v3.0.0-alpha.1 - v3.1.1 GHSA-685w-q87j-wqw3
Unknown
1 month ago
Stale blob descriptor cache invalidation in github.com/distribution/distribution
v3.0.0-alpha.1 - v3.0.0 GO-2026-4942
v3.0.0-alpha.1 - v3.0.0 GO-2026-4942
Unknown
1 month ago
Stale blob descriptor cache invalidation in github.com/distribution/distribution
v3.0.0-alpha.1 - v3.0.0 GO-2026-4942
v3.0.0-alpha.1 - v3.0.0 GO-2026-4942
Unknown
3 months ago
Distribution's tag deletion bypasses `storage.delete.enabled` configuration in github.com/distribution/distribution
v3.0.0-alpha.1 - v3.1.0 GO-2026-5185
v3.0.0-alpha.1 - v3.1.0 GO-2026-5185
Unknown
3 months ago
Distribution's tag deletion bypasses `storage.delete.enabled` configuration in github.com/distribution/distribution
v3.0.0-alpha.1 - v3.1.0 GO-2026-5185
v3.0.0-alpha.1 - v3.1.0 GO-2026-5185
Impacted packages
Timeline
Published
3 months ago
June 25, 2026 at 06:26 PM UTC
Fixed (v3.1.0)
6 months ago
April 06, 2026 at 03:41 PM UTC
Last Modified
3 months ago
July 10, 2026 at 01:29 AM UTC