CVE-2026-85747 in distribution
Summary
by MITRE • 10/14/2026
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body against the requested digest, allowing a malicious or intercepted registry response to substitute attacker-chosen manifest content even when Docker-Content-Digest claims the requested value. The bundled pull-through proxy in registry/proxy/proxymanifeststore.go can cache and re-serve the substituted manifest. This issue is fixed in version 3.1.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The distribution toolkit serves as a foundational component for container registries, responsible for packing, shipping, storing, and delivering container content within ecosystem infrastructure. A critical security flaw exists in versions prior to 3.1.2 regarding the integrity verification of manifest files during digest-pinned requests. When a client or registry proxy retrieves a manifest using a specific content digest as an anchor, it expects cryptographic assurance that the returned data matches exactly what was requested. However, the implementation contains a logic error where the Get method reads the manifest body and passes it directly to the unmarshaling function without performing a subsequent hash verification against the originally requested digest value. This omission creates a significant gap in the chain of trust required for secure container image retrieval.
This vulnerability allows an attacker who can intercept network traffic or compromise the registry server to substitute the expected manifest with maliciously crafted content that does not match the pinned digest. Even if the HTTP response includes a Docker-Content-Digest header claiming to represent the requested value, the client fails to validate this claim against the actual body of the response. Consequently, an attacker can deliver a manipulated manifest that points to compromised container images or introduces unauthorized layers into the deployment pipeline. The bundled pull-through proxy further exacerbates this risk by caching and re-serving these substituted manifests, potentially propagating the malicious content across multiple clients and extending the window of exposure beyond the initial request.
From a technical classification perspective, this flaw aligns with CWE-345 Insufficient Verification of Data Authenticity, as the system fails to verify that the received data matches its expected cryptographic hash. In terms of attack vectors, it relates to ATT&CK technique T1078 Valid Accounts if registry credentials are compromised, or more broadly to supply chain attacks where integrity checks are bypassed during image distribution. The operational impact is severe, as container orchestration platforms rely on these manifests for deployment decisions; accepting a forged manifest can lead to the execution of arbitrary code within production environments under the guise of legitimate software updates.
Mitigation requires immediate upgrading to version 3.1.2 or later where this validation logic has been corrected to ensure that every retrieved manifest is hashed and compared against the requested digest before being processed. Organizations should also implement network-level protections such as TLS inspection with strict certificate pinning to prevent man-in-the-middle attacks during registry communication. Additionally, adopting content trust mechanisms like Docker Content Trust can provide an additional layer of verification by requiring signed manifests, ensuring that only images from trusted sources are deployed regardless of the underlying transport security posture.