Distribution 3.0.x Blob Restore After Delete (v3.1.0 Fix)
CVE-2026-35172 Published on April 6, 2026

Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-35172 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

NONE

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

NONE

Availability Impact:

NONE

Weakness Types

What is an Authorization Vulnerability?

The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE-2026-35172 has been classified to as an Authorization vulnerability or weakness.

Use of Cache Containing Sensitive Information

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere. Applications may use caches to improve efficiency when communicating with remote entities or performing intensive calculations. A cache maintains a pool of objects, threads, connections, pages, financial data, passwords, or other resources to minimize the time it takes to initialize and access these resources. If the cache is accessible to unauthorized actors, attackers can read the cache and obtain this sensitive information.

Products Associated with CVE-2026-35172

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Openshift

Red Hat Openshift Data Foundation

Red Hat Multicluster Engine

Affected Versions

distribution:

Version < 3.1.0 is affected.

Red Hat OpenShift Container Platform 4.12:

Version 1781122773 and below * is unaffected.

Red Hat OpenShift Container Platform 4.13:

Version 1781123052 and below * is unaffected.

Red Hat OpenShift Container Platform 4.14:

Version 1781833795 and below * is unaffected.

Red Hat OpenShift Container Platform 4.15:

Version 1779915499 and below * is unaffected.

Red Hat OpenShift Container Platform 4.16:

Version 1780957268 and below * is unaffected.