Distribution betroffen durch Pull-Through-Cache-Anmeldeinformationen-Exfiltration über www-authenticate bearer realm

The SSRF vulnerability arises from the way GitHub Distribution Registry handles WWW-Authenticate challenges in pull-through cache mode. When configured to use an upstream registry, the registry parses these challenges to discover token authentication endpoints. The realm URL, which specifies the upstream registry host, is used without proper validation. An attacker controlling the upstream registry (or positioned in a man-in-the-middle position) can exploit this by providing a malicious realm URL. This malicious URL could point to an internal service or resource that the registry should not be able to access, effectively allowing the attacker to make requests on behalf of the registry. The potential impact includes exposure of sensitive data, unauthorized access to internal systems, and potentially even remote code execution if the internal service is vulnerable.

Organizations heavily reliant on Docker Distribution's pull-through cache functionality, particularly those with complex registry configurations or shared hosting environments, are at increased risk. Environments where upstream registries are not strictly controlled or monitored are also vulnerable.

• linux / server:

journalctl -u docker -g "upstream registry"

• generic web:

curl -I <docker_registry_url> | grep 'WWW-Authenticate'

1. 2026-04-06Disclosure

   disclosure

2. 2026-04-06Patch

   patch

1. Reserviert2026-03-20
2. Veröffentlicht2026-04-06
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-14

The primary mitigation for CVE-2026-33540 is to upgrade to GitHub Distribution Registry version 3.1.0 or later, which includes the necessary validation to prevent the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter outbound requests from the registry, specifically blocking requests to unexpected or unauthorized hosts. Additionally, review the configuration of your upstream registry to ensure it is not susceptible to manipulation. Monitor registry logs for unusual outbound requests that might indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious realm URL and verifying that the request is blocked.