CVE-2026-68754: Publishers without delete permission can overwrite docker layer information
Published Aug 12, 2026
·Updated
A repository publisher without delete permission may modify protected package content under specific conditions.
Affected Software
1 affected component
Docker
Event History
Aug 12, 2026
CVE Published
via MITRE·02:58 PM
Data Sourced
via MITRE·02:58 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-68754?
CVE-2026-68754 has a medium severity rating of 6.5.
2
How do I fix CVE-2026-68754?
To mitigate CVE-2026-68754, ensure that users without delete permissions cannot modify protected package content.
3
What does CVE-2026-68754 affect?
CVE-2026-68754 affects Docker repositories by allowing publishers without delete permissions to overwrite docker layer information.
4
Who is impacted by CVE-2026-68754?
CVE-2026-68754 impacts repository publishers who do not have delete permissions.
5
What are the conditions for CVE-2026-68754 to occur?
CVE-2026-68754 occurs under specific conditions where a publisher can modify protected package content without sufficient permissions.