Token Authentication Vulnerability in Distribution by Docker

CVE-2026-33540

What is CVE-2026-33540?

The Distribution toolkit by Docker, used for managing container content, has a security weakness in its pull-through cache mode prior to version 3.1.0. The vulnerability arises from the way it discovers token authentication endpoints by interpreting WWW-Authenticate challenges from the configured upstream registry. It improperly utilizes the bearer challenge's realm URL without validating it against the upstream registry host. This oversight allows an attacker, either through a manipulated upstream or a man-in-the-middle scenario, to have the toolkit send upstream credentials via basic authentication to a malicious realm URL. The vulnerability is addressed in version 3.1.0.

References