Description

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-12T15:18:19.967Z",
  "pubdate": "2026-08-12T15:18:19.967Z",
  "executiveSummary": "An authorization bypass vulnerability exists involving the handling of private Open Container Initiative (OCI) referrer metadata.\nThe vulnerability allows an authenticated user lacking explicit repository read permissions to successfully access restricted OCI referrer metadata under specific operational conditions.\nThe primary impact involves the unauthorized disclosure of sensitive supply chain metadata, artifact relationships, and dependency graphs associated with private container registries.\nThe risk implications include potential reconnaissance enabling targeted downstream supply chain attacks or the exposure of proprietary intellectual property tied to containerized application structures.\nAttacker capabilities are constrained by the requirement for prior authentication to the registry, though no read access to the target repository is strictly enforced during the vulnerable transaction.\nExploitation requirements necessitate a valid authenticated user session interacting with the registry API or client interface under the specific conditions that fail to validate repository-level read entitlements against OCI referrer query endpoints.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control enforcement within the OCI registry backend when processing requests for referrer metadata.\nSpecifically, the vulnerable component fails to adequately validate whether the authenticated requesting principal possesses valid repository read permissions before returning OCI referrer objects associated with a specific digest.\nThe attack flow proceeds as follows: First, an authenticated user with minimal or zero repository privileges identifies or targets a private repository containing sensitive container images. Second, the user crafts an API request targeting the OCI distribution specification endpoints designed to query referrer metadata for a known manifest digest. Third, due to the authorization check deficiency, the registry processing logic bypasses the standard repository read-permission evaluation for this specific metadata query path. Finally, the server responds with the requested OCI referrer metadata, exposing structural relationships, vulnerability scan results, signature data, or Software Bill of Materials (SBOM) references that should be restricted.\nAuthentication requirements dictate that the attacker must possess a valid security context or token within the registry environment, verifying their identity to the authentication service.\nPrivilege requirements are notably low regarding the target repository, as the vulnerability explicitly permits users without repository read permissions to retrieve the metadata.\nNetwork exposure is inherent to any OCI-compliant container registry exposing standard distribution APIs over HTTP/HTTPS protocols.\nPost-exploitation impact includes the aggregation of reconnaissance data, allowing unauthorized actors to map internal software architectures, identify vulnerable underlying components linked via referrers, and harvest cryptographic signatures or provenance attestations intended to remain private."
}