{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/distribution/distribution/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/distribution/distribution"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33540"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-06T17:52:52Z",
    "nvd_published_at": "2026-04-06T15:17:10Z",
    "severity": "HIGH"
  },
  "details": "hi guys,\n\ncommit: 40594bd98e6d6ed993b5c6021c93fdf96d2e5851 (as-of 2026-01-31)\ncontact: GitHub Security Advisory (https://github.com/distribution/distribution/security/advisories/new)\n\n## summary\n\nin pull-through cache mode, distribution discovers token auth endpoints by parsing `WWW-Authenticate` challenges returned by the configured upstream registry. the `realm` URL from a bearer challenge is used without validating that it matches the upstream registry host. as a result, an attacker-controlled upstream (or an attacker with MitM position to the upstream) can cause distribution to send the configured upstream credentials via basic auth to an attacker-controlled `realm` URL.\n\nthis is the same vulnerability class as CVE-2020-15157 (containerd), but in distribution\u2019s pull-through cache proxy auth flow.\n\n## severity\n\nHIGH\n\nnote: the baseline impact is credential disclosure of the configured upstream credentials. if a deployment uses broader credentials for upstream auth (for example cloud iam credentials), the downstream impact can be higher; i am not claiming this as default for all deployments.\n\n## impact\n\ncredential exfiltration of the upstream authentication material configured for the pull-through cache.\n\nattacker starting positions that make this realistic:\n- supply chain / configuration: an operator configures a proxy cache to use an upstream that becomes attacker-controlled (compromised registry, stale domain, or a malicious mirror)\n- network: MitM on the upstream connection in environments where the upstream is reachable over insecure transport or a compromised network path\n\n## affected components\n\n- `registry/proxy/proxyauth.go:66-81` (`getAuthURLs`): extracts bearer `realm` from upstream `WWW-Authenticate` without validating destination\n- `internal/client/auth/session.go:485-510` (`fetchToken`): uses the realm URL directly for token fetch\n- `internal/client/auth/session.go:429-434` (`fetchTokenWithBasicAuth`): sends credentials via basic auth to the realm URL\n\n## reproduction\n\nattachment: `poc.zip` (local harness) with canonical and control runs.\n\nthe harness is local and does not contact a real registry: it uses two local HTTP servers (upstream + attacker token service) to demonstrate whether basic auth is sent to an attacker-chosen realm.\n\n```bash\nunzip -q -o poc.zip -d poc\ncd poc\nmake canonical\nmake control\n```\n\nexpected output (excerpt):\n\n```\n[CALLSITE_HIT]: getAuthURLs::configureAuth\n[PROOF_MARKER]: basic_auth_sent=true realm_host=127.0.0.1 account_param=user authorization_prefix=Basic\n```\n\ncontrol output (excerpt):\n\n```\n[CALLSITE_HIT]: getAuthURLs::configureAuth\n[NC_MARKER]: realm_validation=PASS basic_auth_sent=false\n```\n\n## suggested remediation\n\nvalidate that the token `realm` destination is within the intended trust boundary before associating credentials with it or sending any authentication to it. one conservative option is strict same-host binding: only accept a realm whose host matches the configured upstream host.\n\n## fix accepted when\n\n- distribution does not send configured upstream credentials to an attacker-chosen realm URL\n- a regression test covers the canonical and blocked cases\n\n[addendum.md](https://github.com/user-attachments/files/24984637/addendum.md)\n[poc.zip](https://github.com/user-attachments/files/24984638/poc.zip)\n[PR_DESCRIPTION.md](https://github.com/user-attachments/files/24984639/PR_DESCRIPTION.md)\n[RUNNABLE_POC.md](https://github.com/user-attachments/files/24984640/RUNNABLE_POC.md)\n\n\nbest,\noleh",
  "id": "GHSA-3p65-76g6-3w7r",
  "modified": "2026-04-06T23:42:43Z",
  "published": "2026-04-06T17:52:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/distribution/distribution/security/advisories/GHSA-3p65-76g6-3w7r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33540"
    },
    {
      "type": "WEB",
      "url": "https://github.com/distribution/distribution/commit/cc5d5fa4ba02157501e6afa2cc6a903ad0338e7b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/distribution/distribution"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Distribution affected by pull-through cache credential exfiltration via www-authenticate bearer realm"
}