CVE-2026-41888 — Distribution: Tag deletion bypasses `storage.delete.enabled` configuration
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the stora…
Published: 2026-05-14 · CVSS: 6.3 · CVSS 4.0
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7