ZeroDay Findings
Sign inSign up

Findings

CVE-2026-103868

A flaw was found in pulp-container when it authenticates to an upstream registry.

Published Oct 7, 2026 · updated Oct 14, 2026

A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 7, 2026 · NIST NVD

    Detected

    A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream regi

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream regi

Sources

  • CVE.orgVulnerability recordCVE-2026-103868

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-103868

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-103868

    A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives t

    nvd.nist.gov

References