CVE-2026-85747
Distribution: Client does not verify returned content against requested digest
Published Oct 15, 2026 · corrected/updated Oct 15, 2026 · evidence confidence high
### Summary fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for supply-chain integrity — image policy controllers, mirrors, pull-through caches — is silently undermined. The bundled pull-through proxy ( ) is itself an unguarded consumer and is directly exploitable. ### Details **Root cause:** reads the response body and passes it directly to without ever computing and comparing against the caller-supplied . The response header is parsed (lines 251-292 in ) only to populate an out-parameter ( ) and is itself server-supplied — it is never recomputed from the body, so a lying server can set it to whatever value the caller requested while delivering different bytes. **Attack path:** An attacker who controls the registry endpoint (malicious registry, compromised upstream, DNS hijack, or TLS MITM) responds to with: 1. (forged header) 2. A body containing a different, attacker-chosen manifest The client calls on the substituted body, returns the attacker's manifest as if it were the pinned content, and the caller has no way to detect the substitution. **Why it matters:** The entire value of digest pinning is to guarantee content-addressable integrity against exactly this threat model (hostile or MITM server). The pull-through cache calls and immediately writes the result to local storage with no re-verification — so a poisoned remote can permanently inject a bad manifest into the mirror cache, affecting all subsequent consumers. Relevant code path ( , simplified): ### PoC **go.mod:** **main.go:** **Output (v2.8.3+incompatible):** ### Impact Any application that calls with a digest argument — and relies on that digest to guarantee which image conten
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-85747 is a medium public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: github.com/distribution/distribution/v3 (< 3.1.2); github.com/docker/distribution (<= 2.8.3); github.com. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 6.8. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-354. Sources contributing to this record: cve_org, github, gitlab. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · GitHub Advisory Database
Detected
### Summary fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for suppl
Oct 15, 2026 · GitHub Advisory Database
Updated
### Summary fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for suppl
Affected
- go github.com/distribution/distribution/v3< 3.1.2
- go github.com/docker/distribution<= 2.8.3
- golang github.comversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-85747
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-685w-q87j-wqw3
Distribution: Client does not verify returned content against requested digest
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-85747
registry/client.(*manifests).Get(ctx, dgst, …) fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application
advisories.gitlab.com