Security: project-zot/zot
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
zot v2.1.18 digest multi-tag push bypasses update authorization and poisons trusted tagsGHSA-9w95-g7vg-45v6 published
Aug 6, 2026 by rchinchaCritical -
GraphQL API Missing Per-Repository Authorization Allows Authenticated Metadata Disclosure (IDOR)GHSA-6m3h-m7x6-8826 published
Aug 6, 2026 by rchinchaModerate -
Zot logs HTTP event-sink header secrets in plaintextGHSA-x75h-vm25-49xf published
Aug 6, 2026 by rchinchaModerate -
Open Redirect via Backslash in OAuth2 OIDC Callback URL ValidationGHSA-vj6f-mjhx-gv49 published
Aug 6, 2026 by rchinchaModerate -
Bearer authentication maps DELETE to push scope, allowing unauthorized deletionGHSA-qg67-7m6v-qg25 published
Jun 24, 2026 by rchinchaHigh -
Vulnerability Report: Unbounded HTTP Request Body Allocation in zot RegistryGHSA-vm27-w3jg-7wg9 published
Aug 7, 2026 by rchinchaHigh -
Open Redirect via OAuth/OIDC CallbackGHSA-v852-mrr4-vw6m published
Aug 6, 2026 by rchinchaModerate -
create-only policy allows overwrite attempts of existing latest tag (update permission not required)GHSA-85jx-fm8m-x8c6 published
Mar 9, 2026 by rchinchaHigh -
Logged SecretGHSA-c37v-3c8w-crq8 published
May 22, 2025 by rchinchaHigh -
IdP group membership revocation ignoredGHSA-c9p4-xwr9-rfhx published
Jan 17, 2025 by rchinchaHigh