CVE-2026-85747: Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
distributionto a version that resolves this vulnerability.Fixed in 3.1.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Docker Distribution client to retrieve manifests by digest are exposed if they use a version earlier than 3.1.2. The bundled pull-through proxy is also affected because it can cache and later serve a substituted manifest.
What does an attacker need to exploit this?
An attacker needs to provide a malicious registry response or intercept a registry response for a digest-pinned manifest request. The response can contain attacker-chosen manifest content while claiming the requested Docker-Content-Digest value.
Why can the impact persist after a malicious response?
The pull-through proxy can cache the substituted manifest and re-serve it to later clients. This means subsequent consumers of the proxy may receive the substituted content after the original malicious or intercepted response.
What version fixes the issue?
Docker Distribution version 3.1.2 fixes the issue.